@netnodeag/kraftwerk 0.34.1 → 0.35.0

package/dist/inspector/server.js

@@ -1,4 +1,4 @@
-import { promises as fs } from "node:fs";
+import { existsSync, promises as fs } from "node:fs";
 import http from "node:http";
 import path from "node:path";
 import { setOutputDir, setProjectRoot, getOutputDir, getProjectRoot } from "./context.js";
@@ -11,6 +11,7 @@ import { bundleDetail, conceptDetail, createBundle, knowledgeIndex, putConcept,
 import { deleteMember, getMember, listMembers, saveMember, setMemberArchived, teamRoot, } from "./team.js";
 import { deleteAgentSkill, getSkill, listAgentSkills, listSkills, readSkill, saveAgentSkill, skillsRoot, } from "./skills.js";
 import { discoverWorkspaces, forgetProject, listWorkspacesDetailed, markProjectStopped, registerInstance, registerProject, startProject, stopProject, tildify, unregisterInstance, } from "./instances.js";
+import { gitCommit, gitDiff, gitFetch, gitPull, gitPush, gitStatus, startGitSync, } from "./git.js";
 import { getSettings, saveSettings } from "./settings.js";
 import { deleteRoutine, routineStatuses, runRoutineNow, saveRoutine, startRoutineScheduler, } from "./routines.js";
 /**
@@ -57,6 +58,59 @@ function readBody(req) {
         req.on("error", reject);
     });
 }
+/**
+ * Interface to bind. Loopback by default: the UI is unauthenticated and its
+ * chat runs coding agents against the repo, so it must not appear on the LAN
+ * because someone started it on a laptop in a café. Inside a container the
+ * default flips to all interfaces — loopback there would make the published
+ * port unreachable while the in-container health check keeps passing, and
+ * the port mapping (compose publishes to 127.0.0.1) is the boundary anyway.
+ * KRAFTWERK_UI_HOST overrides either way.
+ */
+const IN_CONTAINER = existsSync("/.dockerenv") || existsSync("/run/.containerenv");
+const INSPECTOR_HOST = process.env.KRAFTWERK_UI_HOST || (IN_CONTAINER ? "0.0.0.0" : "127.0.0.1");
+const LOOPBACK_NAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+const LOOPBACK_BIND = LOOPBACK_NAMES.has(INSPECTOR_HOST);
+/**
+ * Whether the Host header names this server. A loopback bind alone does not
+ * keep other sites out: a page on evil.example can re-point that name at
+ * 127.0.0.1 after it loaded (DNS rebinding) and then talk to us as if it
+ * were same-origin — every check that compares Origin to Host passes,
+ * because both say evil.example. So while bound to loopback, only loopback
+ * names are served. Bound elsewhere (a container behind a proxy) the name
+ * is whatever the proxy forwards, and the proxy is the boundary.
+ *
+ * A reverse proxy on the same machine talks to the loopback bind with the
+ * browser's Host, which is not a loopback name. It says so in
+ * X-Forwarded-Host, and that header cannot come from a rebinding page: a
+ * browser only sends it after a CORS preflight, which this server never
+ * answers, and a form post cannot set headers at all.
+ */
+function hostAllowed(req) {
+    if (!LOOPBACK_BIND)
+        return true;
+    if (forwardedHost(req))
+        return true;
+    const host = req.headers.host;
+    if (!host)
+        return true;
+    const name = hostnameOf(host);
+    return LOOPBACK_NAMES.has(name) || name.endsWith(".localhost");
+}
+/** First X-Forwarded-Host value, or undefined when no proxy set one. */
+function forwardedHost(req) {
+    const forwarded = req.headers["x-forwarded-host"];
+    return (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(",")[0].trim() || undefined;
+}
+/** "localhost:1981" → "localhost", "[::1]:1981" → "[::1]"; "" when unparsable. */
+function hostnameOf(host) {
+    try {
+        return new URL(`http://${host}`).hostname;
+    }
+    catch {
+        return "";
+    }
+}
 /** Exit code the `kraftwerk ui` supervisor treats as "relaunch me". */
 export const RESTART_EXIT_CODE = 75;
 /** Whether a supervisor is around to respawn us (set by `kraftwerk ui`). */
@@ -87,9 +141,48 @@ async function getPkgName() {
         return "";
     }
 }
+/**
+ * Whether a state-changing request came from this UI rather than from some
+ * other page the user happens to have open. The inspector has no login of
+ * its own: every POST here writes files, commits, pushes, or starts a coding
+ * agent, and a cross-site form post needs no preflight to reach us. Browsers
+ * attach Origin to every POST/PUT/DELETE, form submissions included, so a
+ * mismatch is a forgery. A missing Origin is a non-browser client (curl, a
+ * script), which was never the attack this guards against.
+ */
+function sameOrigin(req) {
+    if (req.headers["sec-fetch-site"] === "cross-site")
+        return false;
+    const origin = req.headers.origin;
+    if (origin === undefined)
+        return true;
+    // A sandboxed iframe or a redirected form sends "null", which matches no host.
+    if (origin === "null")
+        return false;
+    // A reverse proxy that rewrites Host to the upstream (nginx by default)
+    // says who the browser addressed in X-Forwarded-Host. Trusting it is safe
+    // here: a browser cannot set that header without a CORS preflight, which
+    // this API never answers, and a form post cannot set headers at all.
+    const host = forwardedHost(req) || req.headers.host;
+    if (!host)
+        return false;
+    try {
+        // Parse the host under the origin's scheme so a default port written
+        // out by the proxy ("kw.example.com:443") compares equal to the
+        // browser's Origin, which never carries one.
+        const o = new URL(origin);
+        return o.host === new URL(`${o.protocol}//${host}`).host;
+    }
+    catch {
+        return false;
+    }
+}
 async function handleApi(req, res, url) {
     const seg = url.pathname.split("/").filter(Boolean); // ["api", ...]
     const method = req.method ?? "GET";
+    if (method !== "GET" && method !== "HEAD" && !sameOrigin(req)) {
+        return json(res, { error: "cross-origin request refused" }, 403);
+    }
     // GET /api/meta — package version + project name ("environment") for the UI.
     // ?probe=1 marks a discovery probe from another instance: answer identity
     // only, skip our own discovery (two instances must not probe each other
@@ -120,9 +213,42 @@ async function handleApi(req, res, url) {
             projectIcon: project?.config.icon ?? "",
             projectRoot: project?.root ?? getProjectRoot(),
             projectRootLabel: tildify(project?.root ?? getProjectRoot()),
+            git: (project?.config.git && project.config.git.enabled !== false) === true,
             switcher,
         });
     }
+    // GET /api/git — branch, ahead/behind, changed files (the git screen polls
+    // this, so it is cached for a beat; ?fresh=1 bypasses the cache).
+    if (seg.length === 2 && seg[1] === "git" && method === "GET") {
+        return json(res, await gitStatus(url.searchParams.has("fresh")));
+    }
+    // GET /api/git/diff?path= — unified diff for one file
+    if (seg.length === 3 && seg[1] === "git" && seg[2] === "diff" && method === "GET") {
+        const file = url.searchParams.get("path");
+        if (!file)
+            return json(res, { error: "path required" }, 400);
+        return json(res, await gitDiff(file));
+    }
+    // POST /api/git/commit {paths, message} — stage and commit the selection.
+    // Commit and push stay manual; the background timer never writes history.
+    if (seg.length === 3 && seg[1] === "git" && seg[2] === "commit" && method === "POST") {
+        try {
+            const body = JSON.parse(await readBody(req));
+            const paths = Array.isArray(body.paths) ? body.paths.filter((p) => typeof p === "string") : [];
+            const message = typeof body.message === "string" ? body.message : "";
+            const result = await gitCommit(paths, message);
+            return json(res, result, result.ok ? 200 : 409);
+        }
+        catch (err) {
+            return json(res, { error: err.message }, 400);
+        }
+    }
+    // POST /api/git/{fetch,pull,push}
+    if (seg.length === 3 && seg[1] === "git" && method === "POST" && ["fetch", "pull", "push"].includes(seg[2])) {
+        const run = seg[2] === "fetch" ? gitFetch : seg[2] === "pull" ? gitPull : gitPush;
+        const result = await run();
+        return json(res, result, result.ok ? 200 : 409);
+    }
     // GET /api/projects — every known workspace incl. this one, with state + counts (admin screen)
     if (seg.length === 2 && seg[1] === "projects" && method === "GET") {
         return json(res, await listWorkspacesDetailed());
@@ -170,7 +296,7 @@ async function handleApi(req, res, url) {
     if (seg.length === 2 && seg[1] === "settings" && method === "GET") {
         return json(res, await getSettings());
     }
-    // PUT /api/settings — write the UI-editable subset (name, icon, switcher) back
+    // PUT /api/settings — write the UI-editable subset (name, icon, switcher, git) back
     if (seg.length === 2 && seg[1] === "settings" && method === "PUT") {
         try {
             const input = JSON.parse(await readBody(req));
@@ -659,6 +785,7 @@ export function startInspector(opts) {
     if (opts.projectRoot)
         setProjectRoot(opts.projectRoot);
     startRoutineScheduler();
+    startGitSync();
     // Chat agent subprocesses must die with the server — signals bypass
     // "exit" handlers, so hook the signals themselves.
     for (const sig of ["SIGINT", "SIGTERM"]) {
@@ -679,6 +806,8 @@ export function startInspector(opts) {
     const server = http.createServer(async (req, res) => {
         try {
             const url = new URL(req.url ?? "/", "http://localhost");
+            if (!hostAllowed(req))
+                return json(res, { error: "unexpected Host header" }, 421);
             if (url.pathname.startsWith("/api/"))
                 await handleApi(req, res, url);
             else
@@ -690,7 +819,7 @@ export function startInspector(opts) {
     });
     return new Promise((resolve, reject) => {
         server.once("error", reject);
-        server.listen(opts.port, () => {
+        server.listen(opts.port, INSPECTOR_HOST, () => {
             const addr = server.address();
             const port = typeof addr === "object" && addr ? addr.port : opts.port;
             void registerInstance(port, getProjectRoot());

package/dist/inspector/settings.d.ts

@@ -1,7 +1,7 @@
 import { type ProjectConfig, type SwitcherEntry } from "../config.js";
 /**
  * Workspace settings: read kraftwerk.yml for the UI and write the
- * UI-editable subset (name, icon, switcher) back. Edits go through the
+ * UI-editable subset (name, icon, switcher, git) back. Edits go through the
  * yaml Document API so comments and every other key survive untouched;
  * a missing kraftwerk.yml is created at the project root on first save.
  */
@@ -22,6 +22,16 @@ export interface SaveSettingsInput {
     icon?: string;
     /** Omitted = untouched; empty list = remove the key. */
     switcher?: SwitcherEntry[];
+    /** Omitted = untouched. See cleanGit for how the block is written. */
+    git?: GitSettingsInput;
+}
+/** The git form as the settings screen posts it. Every field but `enabled` may be blank. */
+export interface GitSettingsInput {
+    enabled: boolean;
+    remote?: string;
+    branch?: string;
+    interval?: number | string;
+    autosync?: "off" | "pull" | "";
 }
 export declare function getSettings(): Promise<SettingsView>;
 export declare function saveSettings(input: SaveSettingsInput): Promise<SettingsView>;

package/dist/inspector/settings.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { parseDocument } from "yaml";
 import { resolveProject } from "../config.js";
 import { getProjectRoot } from "./context.js";
+const GIT_DEFAULTS = { remote: "origin", interval: 300, autosync: "pull" };
 export async function getSettings() {
     const project = await resolveProject(getProjectRoot());
     return {
@@ -31,6 +32,43 @@ function cleanSwitcher(value) {
         return icon ? { name, url, icon } : { name, url };
     });
 }
+/**
+ * The git block to write. Defaults are left out so the file only says what
+ * differs from them, and `enabled: false` keeps the other fields so turning
+ * the feature back on restores them. Returns null when the block should not
+ * exist at all: sync off and nothing else set, which is what no block means.
+ */
+function cleanGit(value) {
+    if (typeof value !== "object" || value === null)
+        throw new Error("git must be an object");
+    if (typeof value.enabled !== "boolean")
+        throw new Error("git.enabled must be true or false");
+    const out = {};
+    const remote = typeof value.remote === "string" ? value.remote.trim() : "";
+    if (remote && remote !== GIT_DEFAULTS.remote)
+        out.remote = remote;
+    const branch = typeof value.branch === "string" ? value.branch.trim() : "";
+    if (branch)
+        out.branch = branch;
+    if (value.interval !== undefined && value.interval !== "") {
+        const n = typeof value.interval === "string" ? Number(value.interval) : value.interval;
+        if (!Number.isInteger(n) || n < 0)
+            throw new Error("git.interval must be a whole number of seconds (0 disables the timer)");
+        if (n !== GIT_DEFAULTS.interval)
+            out.interval = n;
+    }
+    if (value.autosync !== undefined && value.autosync !== "") {
+        if (value.autosync !== "off" && value.autosync !== "pull")
+            throw new Error('git.autosync must be "off" or "pull"');
+        if (value.autosync !== GIT_DEFAULTS.autosync)
+            out.autosync = value.autosync;
+    }
+    if (value.enabled)
+        return out;
+    if (Object.keys(out).length === 0)
+        return null;
+    return { enabled: false, ...out };
+}
 export async function saveSettings(input) {
     if (input.name !== undefined && typeof input.name !== "string")
         throw new Error("name must be a string");
@@ -54,6 +92,13 @@ export async function saveSettings(input) {
     setOrDelete("name", input.name?.trim());
     setOrDelete("icon", input.icon?.trim());
     setOrDelete("switcher", switcher);
+    if (input.git !== undefined) {
+        const git = cleanGit(input.git);
+        if (git === null)
+            doc.delete("git");
+        else
+            doc.set("git", git);
+    }
     await fs.writeFile(configPath, doc.toString());
     return getSettings();
 }

package/dist/runner/docker.d.ts

@@ -1,3 +1,4 @@
+export declare const ENV_FILE = "runner.env";
 export interface SandboxOptions {
     /** Consumer project root (where output/ lives). */
     projectRoot: string;

package/dist/runner/docker.js

@@ -22,7 +22,7 @@ import { newRunId, runDirFor } from "../workflow.js";
  * kraftwerk.run make runs discoverable and cancellable (`docker stop`).
  */
 const IMAGE = "kraftwerk-runner";
-const ENV_FILE = "runner.env";
+export const ENV_FILE = "runner.env";
 const PASSTHROUGH_ENV = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"];
 /** Framework package root (contains runner/Dockerfile). */
 const frameworkDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");