@monoes/monomindcli 2.8.4 → 2.9.2

package/.claude/skills/monodesign/scripts/live-server.mjs

@@ -63,6 +63,8 @@ const DESIGN_MD_PATH = PROJECT_CONTEXT.designPath
   : null;
 const DEFAULT_POLL_TIMEOUT = 600_000;   // 10 min — agent re-polls on timeout anyway
 const SSE_HEARTBEAT_INTERVAL = 30_000;  // keepalive ping every 30s
+// Query param name every protected route checks against the per-process credential.
+const AUTH_QUERY_KEY = 'token';
 
 // ---------------------------------------------------------------------------
 // Port detection
@@ -383,6 +385,20 @@ function statOrNull(filePath) {
   try { return fs.statSync(filePath); } catch { return null; }
 }
 
+// Shared gate for every protected route, including /live.js (see its call
+// site for why that one needs it too). Writes the 401 itself and returns
+// false so callers can `if (!requireAuthQueryCred(url, res)) return;`.
+function requireAuthQueryCred(url, res) {
+  const provided = url.searchParams.get(AUTH_QUERY_KEY);
+  const expected = state[AUTH_QUERY_KEY];
+  if (provided !== expected) {
+    res.writeHead(401);
+    res.end('Unauthorized');
+    return false;
+  }
+  return true;
+}
+
 // HTTP request handler
 // ---------------------------------------------------------------------------
 
@@ -398,6 +414,15 @@ function createRequestHandler({ detectScript, liveScriptParts }) {
 
     // --- Scripts ---
     if (p === '/live.js') {
+      // This response embeds the shared bearer credential (below) — unlike
+      // /detect.js and the vendored scripts, it must be gated the same way
+      // every OTHER protected route already is. Without this, requesting this
+      // one route defeats every other route's check: whoever fetches it walks
+      // away with the value that's supposed to distinguish the legitimate
+      // preview tab from any other page. See requireAuthQueryCred() below —
+      // callers must supply the credential the running server printed at
+      // startup (also mirrored into the live-server info file for tooling).
+      if (!requireAuthQueryCred(url, res)) return;
       // Re-read from disk each request so edits to live-browser.js land on
       // the next tab reload. No-store headers prevent browser caching across
       // sessions — during iteration, a cached old script silently breaks
@@ -604,8 +629,19 @@ function createRequestHandler({ detectScript, liveScriptParts }) {
       if (token !== state.token) { res.writeHead(401); res.end('Unauthorized'); return; }
       const filePath = url.searchParams.get('path');
       if (!filePath || filePath.includes('..')) { res.writeHead(400); res.end('Bad path'); return; }
-      const absPath = path.resolve(process.cwd(), filePath);
-      if (!absPath.startsWith(process.cwd())) { res.writeHead(403); res.end('Forbidden'); return; }
+      // Resolve symlinks on BOTH sides before comparing: a lexical prefix check
+      // (path.resolve + startsWith) can't tell a symlink that lexically resolves
+      // inside cwd from one that physically points outside it, and startsWith on
+      // its own also has no path-boundary — "/proj-evil" lexically "starts with"
+      // "/proj". realpath + path.relative closes both gaps (the same pattern
+      // already used correctly elsewhere in this package).
+      let root, absPath;
+      try {
+        root = fs.realpathSync(process.cwd());
+        absPath = fs.realpathSync(path.resolve(process.cwd(), filePath));
+      } catch { res.writeHead(404); res.end('File not found'); return; }
+      const rel = path.relative(root, absPath);
+      if (rel.startsWith('..') || path.isAbsolute(rel)) { res.writeHead(403); res.end('Forbidden'); return; }
       let content;
       try { content = fs.readFileSync(absPath, 'utf-8'); }
       catch { res.writeHead(404); res.end('File not found'); return; }

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <strong>An open-source MCP server that extends Claude Code with a codebase knowledge graph, persistent memory, and multi-agent coordination.</strong><br/>
-  MIT licensed &middot; Fully local &middot; No data leaves your machine
+  Apache 2.0 licensed &middot; Fully local &middot; No data leaves your machine
 </p>
 
 <p align="center">
@@ -14,7 +14,7 @@
   <a href="https://www.npmjs.com/package/monomind"><img src="https://img.shields.io/npm/v/monomind?color=%2300D2AA&label=monomind&style=flat-square" alt="npm" /></a>
   <a href="https://www.npmjs.com/package/monomind"><img src="https://img.shields.io/npm/dm/monomind?color=%2310B981&style=flat-square" alt="downloads" /></a>
   <a href="https://github.com/monoes/monomind/stargazers"><img src="https://img.shields.io/github/stars/monoes/monomind?color=%23F59E0B&style=flat-square" alt="stars" /></a>
-  <a href="https://github.com/monoes/monomind/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-%238B5CF6?style=flat-square" alt="license" /></a>
+  <a href="https://github.com/monoes/monomind/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache_2.0-%238B5CF6?style=flat-square" alt="license" /></a>
   <a href="https://nodejs.org/"><img src="https://img.shields.io/badge/node-%3E%3D20-339933?style=flat-square&logo=node.js&logoColor=white" alt="node" /></a>
 </p>
 
@@ -38,7 +38,7 @@ Monomind is an **open-source CLI and MCP server** that plugs into Claude Code (a
 - **Reusable slash commands** — 30+ development workflows (build, review, debug, TDD, architecture) available as `/mastermind:*` commands inside Claude Code.
 
 ```bash
-npm install -g monomind        # MIT licensed, runs entirely on your machine
+npm install -g monomind        # Apache 2.0 licensed, runs entirely on your machine
 cd your-project && monomind init
 claude mcp add monomind -- npx -y monomind@latest mcp start
 ```
@@ -76,7 +76,7 @@ monomind init --kimicode       # emits .kimi-code/ + AGENTS.md alongside Claude/
 
 | Concern | Answer |
 |---|---|
-| **License** | [MIT](LICENSE) — use it however you want |
+| **License** | [Apache 2.0](LICENSE) — use it however you want |
 | **Data privacy** | Everything runs locally — your code and memory store never leave your machine. The one exception: crash reporting is on by default (`monomind crash-reporting disable` to opt out) — a hard crash in monomind/mono-agent/monotask/mono-clip files a GitHub issue on that tool's own repo via the GitHub API. That's the only network call Monomind itself makes; it never phones a monoes-controlled server. |
 | **Dependencies** | Standard npm packages (tree-sitter, better-sqlite3, sql.js, zod). tree-sitter and better-sqlite3 are native (prebuilt) Node addons, not pure JS/WASM — sql.js is WASM. No post-install scripts that download code. |
 | **Permissions** | Registers as an MCP server — Claude Code controls what tools are available and prompts you before executing anything sensitive. |
@@ -232,11 +232,13 @@ claude mcp add monomind -- npx -y monomind@latest mcp start
 monomind doctor --fix
 ```
 
+> **Semantic routing (opt-in download):** embedding-based task routing needs a local model (~88 MB, `Snowflake/snowflake-arctic-embed-xs` via transformers.js). `monomind init` asks interactively whether to download it — the default is No, and non-interactive/CI installs never download it silently. Declining is fine: routing falls back to keyword mode. Fetch it any time with `monomind download-embeddings` (or `node scripts/download-embedding-model.mjs` on a source checkout).
+
 Open Claude Code. You now have 49 `/mastermind:*` workflows available:
 
 ```bash
 /mastermind:autodev --tillend     # start autonomous code loop
-monomind org run my-team          # run your first AI org (see .monomind/orgs/sample-team.json)
+monomind org run sample-team      # run your first AI org (init writes a runnable sample-team.json — edit it, or run it as-is)
 /mastermind:help                  # show all commands
 ```
 
@@ -445,5 +447,5 @@ graph TD
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/monoes/monomind/main/assets/mascot.png" alt="Monomind" width="72" /><br/>
-  <sub>Built with ♥ by <a href="https://github.com/monoes">monoes</a> · MIT License</sub>
+  <sub>Built with ♥ by <a href="https://github.com/monoes">monoes</a> · Apache 2.0 License</sub>
 </p>

package/dist/src/browser/dashboard/server.d.ts

@@ -3,6 +3,11 @@ interface DashboardServer {
     broadcast(event: StepEvent): void;
     close(): void;
     port: number;
+    /** Returns the bound host:port, or null if not listening. */
+    address(): {
+        address: string;
+        port: number;
+    } | null;
 }
 export declare function getDashboardServer(port?: number): DashboardServer;
 export {};

package/dist/src/browser/dashboard/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/browser/dashboard/server.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,sBAAsB,CAAC;AA2DjE,UAAU,eAAe;IACvB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,kBAAkB,CAAC,IAAI,SAAe,GAAG,eAAe,CAgJvE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/browser/dashboard/server.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,sBAAsB,CAAC;AA6EjE,UAAU,eAAe;IACvB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACrD;AAID,wBAAgB,kBAAkB,CAAC,IAAI,SAAe,GAAG,eAAe,CAiLvE"}

package/dist/src/browser/dashboard/server.js

@@ -4,7 +4,25 @@ import { join, dirname } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
 import { WebSocketServer } from 'ws';
+import { z } from 'zod';
 import { getMonomindDataRoot } from '../../mcp-tools/types.js';
+// Matches StepEvent (workflow/types.ts) exactly. Anything that doesn't fit this
+// shape is rejected rather than relayed — the endpoint used to broadcast whatever
+// JSON it was handed verbatim to every connected client, which the dashboard then
+// wrote into innerHTML with no escaping.
+const StepEventSchema = z.object({
+    runId: z.string().max(256),
+    workflowId: z.string().max(256),
+    workflowName: z.string().max(500),
+    nodeId: z.string().max(256),
+    nodeName: z.string().max(256),
+    eventType: z.enum(['run_started', 'step_started', 'step_completed', 'step_failed', 'run_completed', 'run_stopped']),
+    itemIndex: z.number().optional(),
+    itemTotal: z.number().optional(),
+    durationMs: z.number().optional(),
+    error: z.string().max(2000).optional(),
+    timestamp: z.number(),
+});
 const __dirname = dirname(fileURLToPath(import.meta.url));
 // 4243: the main monomind dashboard owns 4242 — keep this server off that port
 const DEFAULT_PORT = 4243;
@@ -119,20 +137,43 @@ export function getDashboardServer(port = DEFAULT_PORT) {
             return;
         }
         if (req.method === 'POST' && req.url === '/api/mastermind/event') {
+            // Browsers always set Origin on a cross-origin fetch/XHR POST, so a page open
+            // in another tab that tries to forge an event here is caught here — reject it
+            // before even reading the body. A same-machine, non-browser forwarder (the
+            // endpoint's actual intended caller) sends no Origin header at all and is
+            // unaffected.
+            const origin = req.headers.origin;
+            if (typeof origin === 'string') {
+                const host = req.headers.host;
+                let originHost = null;
+                try {
+                    originHost = new URL(origin).host;
+                }
+                catch { /* malformed Origin — treated as mismatch below */ }
+                if (!host || originHost !== host) {
+                    res.writeHead(403, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: false, error: 'cross-origin request rejected' }));
+                    return;
+                }
+            }
             const chunks = [];
             req.on('data', (chunk) => chunks.push(chunk));
             req.on('end', () => {
                 try {
                     const body = Buffer.concat(chunks).toString('utf8');
-                    JSON.parse(body); // validate before broadcast
+                    const parsed = StepEventSchema.parse(JSON.parse(body));
+                    const validated = JSON.stringify(parsed);
                     for (const client of clients) {
                         if (client.readyState === client.OPEN)
-                            client.send(body);
+                            client.send(validated);
                     }
                 }
                 catch (e) {
                     if (process.env.DEBUG || process.env.MONOMIND_DEBUG)
-                        console.error('[dashboard] /api/mastermind/event received invalid JSON, not broadcast:', e);
+                        console.error('[dashboard] /api/mastermind/event rejected invalid payload, not broadcast:', e);
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: false, error: 'payload does not match the expected event shape' }));
+                    return;
                 }
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end('{"ok":true}');
@@ -150,7 +191,15 @@ export function getDashboardServer(port = DEFAULT_PORT) {
         ws.on('close', () => clients.delete(ws));
         ws.on('error', () => clients.delete(ws));
     });
-    httpServer.listen(port);
+    // C3: bind explicitly to 127.0.0.1. Without a host argument, Node binds
+    // to `::` / `0.0.0.0` (every interface) which makes this unauthenticated
+    // server reachable from anyone on the same LAN/VPN/Wi-Fi. The main UI
+    // dashboard (src/ui/server.mjs) and the MCP HTTP server (mcp-server.ts)
+    // already bind loopback-only; this one was missed.
+    // MONOMIND_BROWSE_DASHBOARD_HOST=<host> overrides for users who genuinely
+    // need remote access (e.g. dev container, SSH tunnel terminator).
+    const bindHost = process.env.MONOMIND_BROWSE_DASHBOARD_HOST ?? '127.0.0.1';
+    httpServer.listen(port, bindHost);
     // Maintain RunRecords from step events and persist run transitions to
     // ~/.monomind/browse-runs.json so /api/workflow-runs on the main dashboard is live.
     function trackRun(event) {
@@ -209,6 +258,12 @@ export function getDashboardServer(port = DEFAULT_PORT) {
             wss.close();
             instance = null;
         },
+        address() {
+            const a = httpServer.address();
+            if (a === null || typeof a === 'string')
+                return null;
+            return { address: a.address, port: a.port };
+        },
     };
     return instance;
 }

package/dist/src/browser/dashboard/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/browser/dashboard/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,MAAM,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,+EAA+E;AAC/E,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AACnE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,sFAAsF;AACtF,6DAA6D;AAC7D,KAAK,UAAU,WAAW,CAAC,IAAiB;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC;QAC/B,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YACtD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,kGAAkG;IACpG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY;IAC/C,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3E,cAAc,CAAC,IAAI,CAAC;QACpB,2EAA2E;QAC3E,4EAA4E;QAC5E,yDAAyD;QACzD,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;aACvE,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAChG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACxD,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC;AAQD,IAAI,QAAQ,GAA2B,IAAI,CAAC;AAE5C,MAAM,UAAU,kBAAkB,CAAC,IAAI,GAAG,YAAY;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAE5C,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAClF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACpC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,cAAc,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YACpF,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC1F,MAAM,OAAO,GAAG;oBACd,cAAc;oBACd,YAAY,EAAE,UAAU,IAAI,IAAI;oBAChC,UAAU,EAAE,SAAS,IAAI,IAAI;oBAC7B,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAChE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC5C,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;iBACf,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,uBAAuB,EAAE,CAAC;YACjE,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B;oBAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;4BAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;wBAAE,OAAO,CAAC,KAAK,CAAC,yEAAyE,EAAE,CAAC,CAAC,CAAC;gBACnJ,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAa,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,+BAA+B;QAC/B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAC5D,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAExB,sEAAsE;IACtE,oFAAoF;IACpF,SAAS,QAAQ,CAAC,KAAgB;QAChC,IAAI,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG;gBACJ,EAAE,EAAE,KAAK,CAAC,KAAK;gBACf,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,CAAC;gBACjB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;aACjC,CAAC;YACF,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB;gBAAE,UAAU,CAAC,MAAM,GAAG,kBAAkB,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI;YAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QAC9D,IAAI,KAAK,CAAC,SAAS,KAAK,gBAAgB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YACpE,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;YACzB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;YACtB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC;YAClC,IAAI,KAAK,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3C,CAAC;QACD,kEAAkE;QAClE,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe;YACxE,KAAK,CAAC,SAAS,KAAK,aAAa,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC3E,KAAK,WAAW,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,QAAQ,GAAG;QACT,IAAI;QACJ,SAAS,CAAC,KAAgB;YACxB,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK;YACH,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/browser/dashboard/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,MAAM,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,gFAAgF;AAChF,kFAAkF;AAClF,kFAAkF;AAClF,yCAAyC;AACzC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IACnH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,+EAA+E;AAC/E,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AACnE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,sFAAsF;AACtF,6DAA6D;AAC7D,KAAK,UAAU,WAAW,CAAC,IAAiB;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC;QAC/B,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YACtD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,kGAAkG;IACpG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY;IAC/C,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3E,cAAc,CAAC,IAAI,CAAC;QACpB,2EAA2E;QAC3E,4EAA4E;QAC5E,yDAAyD;QACzD,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;aACvE,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAChG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACxD,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC;AAUD,IAAI,QAAQ,GAA2B,IAAI,CAAC;AAE5C,MAAM,UAAU,kBAAkB,CAAC,IAAI,GAAG,YAAY;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAE5C,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAClF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACpC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,cAAc,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YACpF,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC1F,MAAM,OAAO,GAAG;oBACd,cAAc;oBACd,YAAY,EAAE,UAAU,IAAI,IAAI;oBAChC,UAAU,EAAE,SAAS,IAAI,IAAI;oBAC7B,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAChE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC5C,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;iBACf,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,uBAAuB,EAAE,CAAC;YACjE,8EAA8E;YAC9E,8EAA8E;YAC9E,2EAA2E;YAC3E,0EAA0E;YAC1E,cAAc;YACd,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC9B,IAAI,UAAU,GAAkB,IAAI,CAAC;gBACrC,IAAI,CAAC;oBAAC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;gBACvG,IAAI,CAAC,IAAI,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC;oBAC/E,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACpD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;oBACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;4BAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;wBAAE,OAAO,CAAC,KAAK,CAAC,4EAA4E,EAAE,CAAC,CAAC,CAAC;oBACpJ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAC,CAAC;oBACjG,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAa,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,+BAA+B;QAC/B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAC5D,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,mDAAmD;IACnD,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,WAAW,CAAC;IAC3E,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAElC,sEAAsE;IACtE,oFAAoF;IACpF,SAAS,QAAQ,CAAC,KAAgB;QAChC,IAAI,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG;gBACJ,EAAE,EAAE,KAAK,CAAC,KAAK;gBACf,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,CAAC;gBACjB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;aACjC,CAAC;YACF,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,UAAU,CAAC,MAAM,GAAG,kBAAkB;gBAAE,UAAU,CAAC,MAAM,GAAG,kBAAkB,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI;YAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QAC9D,IAAI,KAAK,CAAC,SAAS,KAAK,gBAAgB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YACpE,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;YACzB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;YACtB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC;YAClC,IAAI,KAAK,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3C,CAAC;QACD,kEAAkE;QAClE,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe;YACxE,KAAK,CAAC,SAAS,KAAK,aAAa,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC3E,KAAK,WAAW,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,QAAQ,GAAG;QACT,IAAI;QACJ,SAAS,CAAC,KAAgB;YACxB,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK;YACH,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,OAAO;YACL,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/browser/dashboard/ui.html

@@ -221,26 +221,26 @@ function render() {
     const stepHtml = (run.steps || []).map(s => `
       <div class="step ${s.status}">
         <span class="step-icon">${s.status==='done'?'✓':s.status==='error'?'✗':'○'}</span>
-        <span class="step-name">${s.name}</span>
-        <span class="step-time">${s.duration ? s.duration+'ms' : ''}</span>
+        <span class="step-name">${escapeHtml(s.name)}</span>
+        <span class="step-time">${s.duration ? escapeHtml(s.duration+'ms') : ''}</span>
       </div>`).join('') + (run.currentStep ? `
       <div class="step current">
         <span class="step-icon">⠸</span>
-        <span class="step-name">${run.currentStep}</span>
+        <span class="step-name">${escapeHtml(run.currentStep)}</span>
         <span class="step-time">running</span>
       </div>` : '');
 
     const pct = run.itemsTotal > 0 ? Math.round(run.itemsProcessed / run.itemsTotal * 100) : 0;
-    const runLog = (logs.get(run.id) || []).slice(-3).join('\n');
+    const runLog = (logs.get(run.id) || []).slice(-3).map(escapeHtml).join('\n');
     return `<div class="run ${run.status==='running'?'active':run.status}">
       <div class="run-header">
-        <div><span class="run-name">${run.workflowName}</span>
-          <span class="status-badge status-${run.status}">${run.status==='completed'?'✓ done':run.status}</span>
+        <div><span class="run-name">${escapeHtml(run.workflowName)}</span>
+          <span class="status-badge status-${run.status}">${run.status==='completed'?'✓ done':escapeHtml(run.status)}</span>
         </div>
         <div class="run-meta">
-          <span>items: ${run.itemsProcessed}/${run.itemsTotal}</span>
+          <span>items: ${escapeHtml(run.itemsProcessed)}/${escapeHtml(run.itemsTotal)}</span>
           <span>elapsed: ${elapsed(run.startedAt)}</span>
-          ${run.status==='running'?'<button class="stop-btn" onclick="stopRun(\''+run.id+'\')">stop</button>':''}
+          ${run.status==='running'?`<button class="stop-btn" data-run-id="${escapeHtml(run.id)}">stop</button>`:''}
         </div>
       </div>
       ${run.itemsTotal > 0 ? `<div class="progress-bar"><div class="progress-fill" style="width:${pct}%"></div></div>` : ''}
@@ -254,6 +254,16 @@ async function stopRun(runId) {
   await fetch(`/stop/${runId}`, { method: 'POST' }).catch(() => {});
 }
 
+// Delegated listener on the stable container — survives render()'s innerHTML
+// replacement of its children, so this only needs to be wired up once. Reading
+// the id from a data-attribute (rather than building an inline onclick="..."
+// string from run.id) means an attacker-controlled run id can't break out of a
+// JS string literal embedded in an HTML attribute.
+document.getElementById('runs').addEventListener('click', (e) => {
+  const btn = e.target.closest('.stop-btn');
+  if (btn) stopRun(btn.dataset.runId);
+});
+
 connect();
 setInterval(render, 1000); // Update elapsed time
 </script>

package/dist/src/browser/workflow/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../src/browser/workflow/store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzD,qBAAa,kBAAmB,SAAQ,KAAK;aACE,KAAK,CAAC,EAAE,OAAO;IAA5D,YAAY,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,OAAO,EAG3D;CACF;AAID,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAoBzE;AAgDD,wBAAsB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrE;AAED,wBAAsB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAwBxE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE;IACzC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;IAClD,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CACpE,CAAC,CAAC,CAWF;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7D;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAalG"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../src/browser/workflow/store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzD,qBAAa,kBAAmB,SAAQ,KAAK;aACE,KAAK,CAAC,EAAE,OAAO;IAA5D,YAAY,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,OAAO,EAG3D;CACF;AAID,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAoBzE;AAgDD,wBAAsB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrE;AAED,wBAAsB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAwBxE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE;IACzC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;IAClD,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CACpE,CAAC,CAAC,CAWF;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7D;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAalG"}

package/dist/src/browser/workflow/store.js

@@ -1,6 +1,7 @@
 import { readFile, mkdir, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { homedir } from 'os';
+import { withDbLock } from '../../utils/db-mutex.js';
 export class WorkflowStoreError extends Error {
     cause;
     constructor(message, cause) {
@@ -64,10 +65,10 @@ async function getDb() {
     created_at INTEGER NOT NULL,
     last_used_at INTEGER NOT NULL
   )`);
-    return { db, flush: async () => {
+    return { db, flush: () => withDbLock(DB_PATH, async () => {
             const data = db.export();
             await writeFile(DB_PATH, Buffer.from(data));
-        } };
+        }) };
 }
 export async function writeRunRecord(record) {
     const { db, flush } = await getDb();