@lchase/kiln 0.6.0 → 0.7.0

package/dist/serve-page.js

@@ -5,6 +5,7 @@ import { readBoardFiles, stageOf, stagesFor } from "./board.js";
 import { feedbackRoundLabel } from "./feedback.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
 import { packageRoot } from "./paths.js";
+import { listWorkflowNames } from "./workflow.js";
 const REVIEWERS = [
     ["security", "sec"],
     ["ux", "ux"],
@@ -22,7 +23,8 @@ function kilnVersion() {
     }
 }
 const VERSION = kilnVersion();
-export function renderConsole(css, attention) {
+export function renderConsole(css, attention, page) {
+    const intake = page ?? { csrf: "", repos: [], workflows: listWorkflowNames() };
     const items = [...attention.needsYou, ...attention.inFlight, ...attention.doneRecently];
     const stages = stagesFor(items.map((item) => item.job));
     const grouped = new Map();
@@ -46,27 +48,34 @@ export function renderConsole(css, attention) {
 <div class="brand"><span class="logo" aria-hidden="true"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#fff" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M3 12V6l5-3 5 3v6l-5 3-5-3z"/><path d="M3 6l5 3 5-3M8 9v6"/></svg></span><h1>Kiln</h1>${version}</div>
 <div class="status" id="status">${items.length === 1 ? "1 job" : `${items.length} jobs`}</div>
 </header>
+<p class="meta config-error" id="config-error" role="status"${intake.configError ? "" : " hidden"}>${escapeHtml(intake.configError ?? "")}</p>
 <nav class="repos" aria-label="Filter by repo">${chips}</nav>
 <main class="board" id="board" style="--cols: ${tracks}">
 ${columns}
 </main>
 <nav class="toolbar" aria-label="Kiln commands">
+<button class="tool" type="button" id="add-job" data-tip="Add job" aria-label="Add job"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M12 5v14M5 12h14"/></svg></button>
 <button class="tool" type="button" data-act="approve" data-tip="Approve" aria-label="Approve"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M5 12.5l4.5 4.5L19 7.5"/></svg></button>
 <button class="tool" type="button" data-act="retry" data-tip="Retry" aria-label="Retry"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M3 12a9 9 0 1 0 3-6.7L3 8M3 3v5h5"/></svg></button>
 <button class="tool" type="button" data-act="pr" data-tip="Open pull request" aria-label="Open pull request"><svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="6" cy="6" r="2.5"/><circle cx="6" cy="18" r="2.5"/><circle cx="18" cy="18" r="2.5"/><path d="M6 8.5v7M18 15.5V10a3 3 0 0 0-3-3h-3"/></svg></button>
 <button class="tool" type="button" id="notify" data-tip="Notify me" aria-label="Notify me"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M6 8a6 6 0 0 1 12 0c0 7 3 7 3 7H3s3 0 3-7"/><path d="M10 19a2 2 0 0 0 4 0"/></svg></button>
 <span class="sep" aria-hidden="true"></span>
 <button class="tool" type="button" id="compact" aria-pressed="true" data-tip="expand empty columns" aria-label="expand empty columns"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M3 12h7m0 0-3-3m3 3-3 3M21 12h-7m0 0 3-3m-3 3 3 3M12 4v16"/></svg></button>
+<span class="sep" aria-hidden="true"></span>
+<button class="tool" type="button" id="open-settings" data-tip="Settings" aria-label="Settings"><svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="3"/><path d="M12 3v2.2M12 18.8V21M3 12h2.2M18.8 12H21M5.6 5.6l1.6 1.6M16.8 16.8l1.6 1.6M18.4 5.6l-1.6 1.6M7.2 16.8l-1.6 1.6"/></svg></button>
 </nav>
 <div class="scrim" data-close></div>
 <aside class="drawer" id="drawer" role="dialog" aria-modal="true" aria-label="Job">
-${items.map((item) => sheet(item)).join("\n")}
+${intakeSheet(intake, items)}
+${settingsSheet()}
+${items.map((item) => sheet(item, intake.csrf)).join("\n")}
 </aside>`;
     return document({
         css,
         title: `(${attention.needsYouCount}) Kiln`,
         needsYou: attention.needsYouCount,
         revision: attention.revision,
+        csrf: intake.csrf,
         live: true,
         body,
     });
@@ -114,7 +123,7 @@ function card(item, stage) {
         classes.push("retrying");
     else if (stage === "needs-human")
         classes.push("human");
-    if (stage === "merged")
+    if (stage === "done" || stage === "merged")
         classes.push("merged");
     if (stage === "queued")
         classes.push("queued");
@@ -124,7 +133,7 @@ function card(item, stage) {
     const branch = branchOf(job);
     return `<div role="button" tabindex="0" class="${classes.join(" ")}" id="job-${escapeHtml(job.jobId)}" data-job="${escapeHtml(job.jobId)}" data-deps="${escapeHtml(deps)}" data-repo="${escapeHtml(job.repo)}" data-stage="${escapeHtml(stage)}">
 <div class="card-top">${pulse}<span class="num">${escapeHtml(job.jobId)}</span>${flag}</div>
-<div class="branch repo">${escapeHtml(job.repo)}</div>
+<div class="branch repo">${escapeHtml(repoLabel(job))}</div>
 <p class="title">${escapeHtml(job.title || job.jobId)}</p>
 ${branch ? `<div class="branch">${escapeHtml(branch)}</div>` : ""}
 ${sandboxHtml(job)}
@@ -135,7 +144,130 @@ ${waiting ? "" : noteHtml(item)}
 ${dependsHtml(job)}
 </div>`;
 }
-function sheet(item) {
+function intakeSheet(intake, items) {
+    return `<section class="sheet intake" id="intake" aria-label="Add job" hidden>
+<div class="d-head">
+<div class="num">kiln add</div>
+<h3>Add job</h3>
+<button type="button" class="close" data-close aria-label="Close">×</button>
+</div>
+<form id="add-form" class="intake-form">
+<div class="field"><span class="k">Repo</span><div class="picks" id="repo-pick">${repoButtons(intake.repos)}</div></div>
+<label class="field"><span class="k">Workflow</span><select id="workflow" name="workflow">${workflowOptions(intake.workflows)}</select></label>
+<div class="seg" role="tablist" aria-label="Source">
+<button type="button" data-source="prompt" aria-pressed="true">Prompt</button>
+<button type="button" data-source="spec" aria-pressed="false">Spec file</button>
+<button type="button" data-source="tickets" aria-pressed="false">Tickets folder</button>
+<button type="button" data-source="jira" aria-pressed="false">Jira</button>
+</div>
+<div data-pane="prompt"><label class="field"><span class="k">Prompt</span><textarea id="prompt-text" rows="4" placeholder="What should this job do?"></textarea></label></div>
+<div id="browser-field" hidden>
+<div class="k" id="browser-label">Spec file</div>
+<div class="fs" id="browser"></div>
+<p class="meta" id="picked"></p>
+</div>
+<div data-pane="jira" hidden><label class="field"><span class="k">Jira key</span><input id="jira-key" type="text" placeholder="PROJ-123" autocomplete="off" spellcheck="false"></label></div>
+<label class="field" id="issue-field"><span class="k">Issue</span><input id="job-issue" type="text" placeholder="ABC-123" autocomplete="off" spellcheck="false"></label>
+<label class="field" id="title-field"><span class="k">Title</span><input id="job-title" type="text" autocomplete="off"></label>
+<fieldset class="field" id="after-field"><legend class="k">After</legend><div id="after-list">${afterOptions(items)}</div></fieldset>
+<pre class="text preview" id="intake-preview" hidden></pre>
+<p class="form-error" id="intake-error" role="alert" hidden></p>
+<div class="d-actions"><button type="button" id="preview-job" hidden>Preview</button><button type="submit">Add</button></div>
+</form>
+</section>`;
+}
+function settingsSheet() {
+    return `<section class="sheet intake" id="settings" aria-label="Settings" hidden>
+<div class="d-head">
+<div class="num">kiln.config.json</div>
+<h3>Settings</h3>
+<button type="button" class="close" data-close aria-label="Close">×</button>
+</div>
+<form id="settings-form" class="intake-form">
+<p class="meta" id="settings-path"></p>
+<p class="saved" id="settings-saved" role="status" hidden>Saved</p>
+<p class="form-error" id="settings-error" role="alert" hidden></p>
+<div class="seg" role="tablist" aria-label="Settings sections">
+<button type="button" data-settings-tab="repos" aria-pressed="true">Repos</button>
+<button type="button" data-settings-tab="global" aria-pressed="false">Global</button>
+</div>
+<div id="settings-repos">
+<div id="repo-editor" hidden>
+<label class="field"><span class="k">Name</span><input id="repo-name" type="text" autocomplete="off" spellcheck="false"></label>
+<p class="field-error" data-error="name" hidden></p>
+<div class="field"><span class="k">Path</span><div class="path-row"><input id="repo-path" type="text" autocomplete="off" spellcheck="false" placeholder="~/code/web"><button type="button" class="pick" id="repo-browse">Browse</button></div></div>
+<div class="fs" id="repo-browser" hidden></div>
+<p class="field-error" data-error="path" hidden></p>
+<label class="field"><span class="k">Test command</span><input id="repo-test" type="text" autocomplete="off" spellcheck="false" placeholder="npm test"></label>
+<p class="field-error" data-error="test" hidden></p>
+<div class="field"><span class="k">Deliver</span><div class="seg" id="repo-deliver" role="group" aria-label="Deliver mode">
+<button type="button" data-deliver="local" aria-pressed="true">local</button>
+<button type="button" data-deliver="pr" aria-pressed="false">pr</button>
+</div></div>
+<p class="field-error" data-error="deliver" hidden></p>
+<label class="field"><span class="k">Base branch</span><input id="repo-base" type="text" autocomplete="off" spellcheck="false" placeholder="main"></label>
+<p class="field-error" data-error="base" hidden></p>
+<label class="field"><span class="k">PR title template</span><input id="repo-pr-title" type="text" autocomplete="off" spellcheck="false"></label>
+<p class="hint" id="hint-pr-title">Default [{issue}] {title}, which renders as [ABC-123] Title.</p>
+<p class="field-error" data-error="prTitle" hidden></p>
+<label class="field"><span class="k">Branch template</span><input id="repo-branch" type="text" autocomplete="off" spellcheck="false"></label>
+<p class="hint" id="hint-branch">Default {issue}-{slug}, which renders as ABC-123-slug.</p>
+<p class="field-error" data-error="branch" hidden></p>
+<div class="d-actions"><button type="button" id="repo-done">Done</button></div>
+</div>
+<div id="repo-list"></div>
+<div class="d-actions"><button type="button" id="repo-add">Add repo</button></div>
+</div>
+<div id="settings-global" hidden>
+<div class="field"><span class="k">Sandbox</span><div class="seg" id="sandbox-mode" role="group" aria-label="Sandbox mode">
+<button type="button" data-sandbox="off" aria-pressed="true">Off</button>
+<button type="button" data-sandbox="docker" aria-pressed="false">Docker</button>
+</div>
+<p class="hint">Off leaves the agent unsandboxed. Docker runs agent steps in the sandbox.</p>
+<p class="field-error" data-error="sandbox.mode" hidden></p></div>
+<label class="field"><span class="k">Allow domains</span><textarea id="sandbox-domains" rows="3" placeholder="example.com" spellcheck="false"></textarea></label>
+<p class="hint">One hostname per line. When set, this replaces the built-in host list.</p>
+<p class="field-error" data-error="sandbox.allowDomains" hidden></p>
+<label class="field"><span class="k">Max attempts</span><input id="max-attempts" type="number" min="1" step="1"></label>
+<p class="hint" id="hint-attempts"></p>
+<p class="field-error" data-error="maxAttempts" hidden></p>
+<label class="field"><span class="k">Stall timeout (ms)</span><input id="stall-timeout" type="number" step="1"></label>
+<p class="hint" id="hint-stall"></p>
+<p class="field-error" data-error="stallTimeoutMs" hidden></p>
+<label class="field"><span class="k">Max fix rounds</span><input id="max-fix-rounds" type="number" min="1" step="1"></label>
+<p class="hint" id="hint-fix"></p>
+<p class="field-error" data-error="maxFixRounds" hidden></p>
+</div>
+<div class="d-actions"><button type="submit">Save</button></div>
+</form>
+</section>`;
+}
+function repoButtons(repos) {
+    if (repos.length === 0)
+        return `<p class="empty">No repos are registered.</p>`;
+    return repos
+        .map((repo, index) => `<button type="button" class="pick" data-repo="${escapeHtml(repo.name)}" data-path="${escapeHtml(repo.path)}" aria-pressed="${index === 0 ? "true" : "false"}">${escapeHtml(repo.name)}</button>`)
+        .join("");
+}
+function workflowOptions(names) {
+    if (names.length === 0)
+        return `<option value="">none</option>`;
+    return names
+        .map((name) => `<option value="${escapeHtml(name)}"${name === "feature" ? " selected" : ""}>${escapeHtml(name)}</option>`)
+        .join("");
+}
+function afterOptions(items) {
+    const open = items.filter((item) => item.job.state !== "done");
+    if (open.length === 0)
+        return `<p class="empty">No open jobs.</p>`;
+    return open
+        .map((item) => {
+        const job = item.job;
+        return `<label class="after"><input type="checkbox" name="after" value="${escapeHtml(job.jobId)}"><span class="num">${escapeHtml(job.jobId)}</span><span>${escapeHtml(job.title || job.jobId)}</span></label>`;
+    })
+        .join("");
+}
+function sheet(item, csrf) {
     const job = item.job;
     const files = displayFiles(job);
     const round = lastRound(job);
@@ -149,7 +281,7 @@ function sheet(item) {
 ${branch ? `<div class="branch">${escapeHtml(branch)}</div>` : ""}
 ${sandboxHtml(job)}
 ${prLink(job)}
-${actionsHtml(item)}
+${actionsHtml(item, csrf)}
 <button type="button" class="close" data-close aria-label="Close">×</button>
 </div>
 <div class="d-body">${filesNav(files, job)}</div>
@@ -184,17 +316,18 @@ function routeLinks(job) {
         return "";
     return `<div class="group">Open</div>${links.join("")}`;
 }
-function actionsHtml(item) {
+function actionsHtml(item, csrf) {
     const id = encodeURIComponent(item.job.jobId);
+    const token = `<input type="hidden" name="csrf" value="${escapeHtml(csrf)}">`;
     const forms = [];
     if (item.job.canApprove) {
-        forms.push(`<form method="post" action="/api/jobs/${id}/approve" class="act approve"><button type="submit">Approve</button></form>`);
+        forms.push(`<form method="post" action="/api/jobs/${id}/approve" class="act approve">${token}<button type="submit">Approve</button></form>`);
     }
     if (item.job.canReject) {
-        forms.push(`<form method="post" action="/api/jobs/${id}/reject" class="act reject"><button type="submit">Reject</button></form>`);
+        forms.push(`<form method="post" action="/api/jobs/${id}/reject" class="act reject">${token}<button type="submit">Reject</button></form>`);
     }
     if (item.retry) {
-        forms.push(`<form method="post" action="/api/jobs/${id}/retry" class="act retry"><button type="submit">Retry</button></form>`);
+        forms.push(`<form method="post" action="/api/jobs/${id}/retry" class="act retry">${token}<button type="submit">Retry</button></form>`);
     }
     if (forms.length === 0)
         return "";
@@ -268,10 +401,21 @@ function noteHtml(item) {
     }
     return `<div class="note">${lines.map((line) => escapeHtml(line)).join("<br>")}</div>`;
 }
+function repoLabel(job) {
+    if (job.deliver === "local" || job.deliver === "pr")
+        return `${job.repo} · ${job.deliver}`;
+    return job.repo;
+}
 function noteText(item) {
     const job = item.job;
-    if (job.state === "done")
-        return safeUrl(job.prUrl) ? "merged via PR" : "landed locally";
+    if (job.state === "done") {
+        if (job.prNumber)
+            return `merged · PR #${job.prNumber}`;
+        if (safeUrl(job.prUrl))
+            return "merged · PR";
+        const branch = branchOf(job);
+        return branch ? `landed locally · ${branch}` : "landed locally";
+    }
     return item.reason;
 }
 function dependsHtml(job) {
@@ -348,7 +492,7 @@ function document(options) {
 ${options.css}
 </style>
 </head>
-<body data-needs-you="${options.needsYou}" data-revision="${escapeHtml(options.revision)}">
+<body data-needs-you="${options.needsYou}" data-revision="${escapeHtml(options.revision)}" data-csrf="${escapeHtml(options.csrf ?? "")}">
 ${options.body}
 ${options.live ? `<script>\n${LIVE_SCRIPT}\n</script>` : ""}
 </body>

package/dist/serve.js

@@ -1,12 +1,20 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
-import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
+import { AUTH_PREFLIGHT_PREFIX } from "./auth.js";
+import { loadKilnConfig } from "./config.js";
 import { answerJob, readStatus, retryJob, runTick, startupRecovery } from "./driver.js";
+import { browse } from "./fs-browse.js";
 import { defaultHost } from "./host.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
+import { intakeJobs } from "./intake-http.js";
 import { packageRoot } from "./paths.js";
 import { SANDBOX_PREFLIGHT_PREFIX } from "./sandbox.js";
 import { renderConsole, renderMessagePage, renderTextPage } from "./serve-page.js";
+import { readSettings, saveSettings } from "./settings.js";
+import { listWorkflowNames } from "./workflow.js";
 const BODY_LIMIT = 65_536;
 const TEXT_LIMIT = 100_000;
 const JOB_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -17,14 +25,15 @@ const JOB_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 export function startServe(options) {
     startupRecovery(options.config);
     const css = loadServeCss();
-    const secrets = secretValues(options.config);
+    const csrf = randomBytes(32).toString("hex");
+    const state = openLiveConfig(options.config);
     let port = options.port;
     return new Promise((resolvePromise, reject) => {
         const server = createServer((req, res) => {
-            void handle(req, res, options.config, () => port, css, secrets).catch((error) => {
+            void handle(req, res, state, () => port, css, csrf).catch((error) => {
                 const message = error instanceof Error ? error.message : String(error);
                 const status = statusCode(error) ?? 500;
-                sendJson(res, status, { error: redact(message, secrets) }, secrets);
+                sendJson(res, status, { error: redact(message, state.secrets) }, state.secrets);
             });
         });
         server.on("error", reject);
@@ -56,7 +65,8 @@ export function startServe(options) {
             const tick = () => {
                 if (stopped)
                     return;
-                safeTick(options.config, secrets, false);
+                refreshLiveConfig(state);
+                safeTick(state.config, state.secrets, false);
             };
             firstTick = setTimeout(tick, 0);
             timer = setInterval(tick, options.tickSeconds * 1000);
@@ -73,7 +83,7 @@ export function loadServeCss() {
 function safeTick(config, secrets, startup) {
     try {
         const report = runTick(config, defaultHost(), { startup });
-        if (report.startsWith(SANDBOX_PREFLIGHT_PREFIX)) {
+        if (report.startsWith(SANDBOX_PREFLIGHT_PREFIX) || report.startsWith(AUTH_PREFLIGHT_PREFIX)) {
             const tickAt = report.indexOf("\ntick ");
             const head = tickAt === -1 ? report : report.slice(0, tickAt);
             process.stderr.write(`${redact(head.trimEnd(), secrets)}\n`);
@@ -84,7 +94,10 @@ function safeTick(config, secrets, startup) {
         process.stderr.write(`tick: ${redact(message, secrets)}\n`);
     }
 }
-async function handle(req, res, config, boundPort, css, secrets) {
+async function handle(req, res, state, boundPort, css, csrf) {
+    refreshLiveConfig(state);
+    const config = state.config;
+    const secrets = state.secrets;
     const method = req.method ?? "GET";
     const url = new URL(req.url ?? "/", "http://127.0.0.1");
     const path = url.pathname;
@@ -93,12 +106,60 @@ async function handle(req, res, config, boundPort, css, secrets) {
         res.end();
         return;
     }
+    if (method === "GET" && path === "/api/settings") {
+        if (!originAllowed(req, boundPort())) {
+            sendJson(res, 403, { error: "Cross-origin request rejected." }, secrets);
+            return;
+        }
+        const result = readSettings(config.configPath);
+        if (!result.ok) {
+            sendJson(res, result.status, result.body, secrets);
+            return;
+        }
+        sendJson(res, 200, result.document, secrets);
+        return;
+    }
+    if (method === "GET" && path === "/api/fs") {
+        if (!originAllowed(req, boundPort())) {
+            sendJson(res, 403, { error: "Cross-origin request rejected." }, secrets);
+            return;
+        }
+        try {
+            sendJson(res, 200, browse(homedir(), url.searchParams.get("path") ?? undefined), secrets);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            sendJson(res, statusCode(error) ?? 500, { error: message }, secrets);
+        }
+        return;
+    }
+    if (method === "PUT" && path === "/api/settings") {
+        const raw = await readBody(req);
+        if (!originAllowed(req, boundPort())) {
+            sendJson(res, 403, { error: "Cross-origin request rejected." }, secrets);
+            return;
+        }
+        if (!csrfOk(csrf, req, raw)) {
+            sendJson(res, 403, { error: "CSRF token rejected." }, secrets);
+            return;
+        }
+        await putSettings(req, res, state, raw);
+        return;
+    }
     if (method === "POST") {
-        await drain(req);
+        const raw = await readBody(req);
         if (!originAllowed(req, boundPort())) {
             sendJson(res, 403, { error: "Cross-origin request rejected." }, secrets);
             return;
         }
+        if (!csrfOk(csrf, req, raw)) {
+            sendJson(res, 403, { error: "CSRF token rejected." }, secrets);
+            return;
+        }
+        if (path === "/api/jobs") {
+            await createJob(req, res, state, raw);
+            return;
+        }
         const action = /^\/api\/jobs\/([^/]+)\/(approve|reject|retry)$/.exec(path);
         if (!action?.[1] || (action[2] !== "approve" && action[2] !== "reject" && action[2] !== "retry")) {
             sendJson(res, 404, { error: "Not found." }, secrets);
@@ -121,11 +182,11 @@ async function handle(req, res, config, boundPort, css, secrets) {
         return;
     }
     if (path === "/" || path === "" || path === "/board") {
-        sendHtml(res, 200, renderConsole(css, readStatus(config).attention), secrets);
+        sendHtml(res, 200, renderConsole(css, readStatus(config).attention, pageOptions(state, csrf)), secrets);
         return;
     }
-    if (path === "/api/jobs") {
-        sendJson(res, 200, readStatus(config), secrets);
+    if (path === "/api/jobs" || path === "/api/status") {
+        sendJson(res, 200, statusDocument(state), secrets);
         return;
     }
     const apiJob = /^\/api\/jobs\/([^/]+)$/.exec(path);
@@ -238,12 +299,15 @@ function findJob(config, jobId) {
     }
 }
 /**
+ * Host must be localhost or 127.0.0.1 on the bound port.
  * Browsers send Origin on POST. A cross-site page cannot use this server:
- * the header has to be exactly `http://127.0.0.1:<bound port>`.
+ * Origin, when present, has to be `http://127.0.0.1:<port>` or `http://localhost:<port>`.
  * Curl and other non-browser clients omit Origin and are allowed.
  * `Sec-Fetch-Site: cross-site` is rejected even when Origin is absent.
  */
 export function originAllowed(req, port) {
+    if (!hostAllowed(req, port))
+        return false;
     const fetchSite = req.headers["sec-fetch-site"];
     if (fetchSite === "cross-site")
         return false;
@@ -252,7 +316,14 @@ export function originAllowed(req, port) {
         return false;
     if (origin === undefined)
         return true;
-    return origin === `http://127.0.0.1:${port}`;
+    return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
+}
+function hostAllowed(req, port) {
+    const host = req.headers.host;
+    if (typeof host !== "string")
+        return false;
+    const value = host.trim().toLowerCase();
+    return value === `127.0.0.1:${port}` || value === `localhost:${port}`;
 }
 function redirectTarget(req) {
     const referer = req.headers.referer;
@@ -316,16 +387,178 @@ function readInside(kilnDir, target) {
         return text;
     return `showing the last ${TEXT_LIMIT} characters\n\n${text.slice(text.length - TEXT_LIMIT)}`;
 }
-async function drain(req) {
+async function readBody(req) {
+    const chunks = [];
     let size = 0;
     for await (const chunk of req) {
-        size += chunk.length;
+        const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buf.length;
         if (size > BODY_LIMIT) {
             const error = new Error("Request body is too large.");
             error.statusCode = 413;
             throw error;
         }
+        chunks.push(buf);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function csrfOk(expected, req, body) {
+    const header = req.headers["x-kiln-csrf"];
+    const fromHeader = typeof header === "string" ? header : undefined;
+    let fromForm;
+    if (headerValue(req.headers["content-type"]).includes("application/x-www-form-urlencoded")) {
+        fromForm = new URLSearchParams(body).get("csrf") ?? undefined;
+    }
+    const provided = fromHeader || fromForm;
+    if (!provided)
+        return false;
+    const left = Buffer.from(expected);
+    const right = Buffer.from(provided);
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+async function putSettings(req, res, state, raw) {
+    const secrets = state.secrets;
+    if (!headerValue(req.headers["content-type"]).includes("application/json")) {
+        sendJson(res, 400, { error: "Content-Type must be application/json." }, secrets);
+        return;
+    }
+    let parsed;
+    if (!raw.trim()) {
+        sendJson(res, 400, { error: "Request body must be a JSON object." }, secrets);
+        return;
+    }
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        sendJson(res, 400, { error: "Request body is not JSON." }, secrets);
+        return;
+    }
+    const result = saveSettings(state.config.configPath, parsed, homedir());
+    if (!result.ok) {
+        sendJson(res, result.status, result.body, secrets);
+        return;
+    }
+    state.mtimeMs = -1;
+    state.size = -1;
+    refreshLiveConfig(state);
+    sendJson(res, 200, result.document, state.secrets);
+}
+async function createJob(req, res, state, raw) {
+    const secrets = state.secrets;
+    if (!headerValue(req.headers["content-type"]).includes("application/json")) {
+        sendJson(res, 400, { error: "Content-Type must be application/json." }, secrets);
+        return;
+    }
+    let parsed;
+    if (!raw.trim()) {
+        sendJson(res, 400, { error: "Request body must be a JSON object." }, secrets);
+        return;
     }
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        sendJson(res, 400, { error: "Request body is not JSON." }, secrets);
+        return;
+    }
+    try {
+        const result = await intakeJobs(state.config, parsed);
+        sendJson(res, 200, result, state.secrets);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        sendJson(res, statusCode(error) ?? 400, { error: message }, state.secrets);
+    }
+}
+function openLiveConfig(config) {
+    const file = fileStamp(config.configPath);
+    return {
+        config,
+        secrets: secretValues(config),
+        mtimeMs: file?.mtimeMs ?? 0,
+        size: file?.size ?? -1,
+    };
+}
+/**
+ * Re-read the kiln config when the file's mtime or size changed.
+ * A file that does not parse keeps the last good config and records `configError`.
+ * The failed stamp is not stored, so the next request tries again.
+ */
+function refreshLiveConfig(state) {
+    const path = state.config.configPath;
+    const file = fileStamp(path);
+    if (!file) {
+        state.configError = redact(`Could not read kiln config ${path}: the file is missing.`, redactSecrets(state, path));
+        return;
+    }
+    if (file.mtimeMs === state.mtimeMs && file.size === state.size)
+        return;
+    try {
+        const next = loadKilnConfig(path);
+        state.config = next;
+        state.secrets = secretValues(next);
+        state.configError = undefined;
+        state.mtimeMs = file.mtimeMs;
+        state.size = file.size;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const named = message.includes(path) ? message : `${path}: ${message}`;
+        state.configError = redact(named, redactSecrets(state, path));
+    }
+}
+function fileStamp(path) {
+    try {
+        const stat = statSync(path);
+        return { mtimeMs: stat.mtimeMs, size: stat.size };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Last good secrets, plus a token sitting in a file that failed to load. */
+function redactSecrets(state, configPath) {
+    const secrets = [...state.secrets];
+    const disk = tokenFromDisk(configPath);
+    if (disk && !secrets.includes(disk))
+        secrets.push(disk);
+    return secrets;
+}
+function tokenFromDisk(configPath) {
+    try {
+        const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+        const token = parsed.jira?.apiToken;
+        if (typeof token !== "string")
+            return undefined;
+        const trimmed = token.trim();
+        return trimmed.length >= 8 ? trimmed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function repoList(config) {
+    return Object.entries(config.repos)
+        .map(([name, repo]) => ({ name, path: repo.path }))
+        .sort((left, right) => left.name.localeCompare(right.name));
+}
+function pageOptions(state, csrf) {
+    return {
+        csrf,
+        repos: repoList(state.config),
+        workflows: listWorkflowNames(),
+        ...(state.configError ? { configError: state.configError } : {}),
+    };
+}
+function statusDocument(state) {
+    return {
+        ...readStatus(state.config),
+        repos: repoList(state.config),
+        configError: state.configError ?? null,
+    };
 }
 function statusCode(error) {
     if (typeof error === "object" && error !== null && "statusCode" in error) {
@@ -362,7 +595,12 @@ function redirect(res, location) {
     res.end();
 }
 function secretValues(config) {
-    const values = [config.jira?.apiToken, process.env.JIRA_API_TOKEN];
+    const values = [
+        config.jira?.apiToken,
+        process.env.JIRA_API_TOKEN,
+        process.env.CLAUDE_CODE_OAUTH_TOKEN,
+        process.env.ANTHROPIC_API_KEY,
+    ];
     const found = [];
     for (const value of values) {
         const trimmed = value?.trim();