@netnodeag/kraftwerk 0.34.2 → 0.35.0

package/README.md

@@ -160,6 +160,20 @@ kraftwerk run --sandbox website-check "https://..."   # isolated container per r
 kraftwerk runner ps / stop <run-id>     # see / stop running sandbox containers
 ```
 
+The inspector binds `127.0.0.1` — it has no authentication of its own and
+its chat runs coding agents against the repo, so it stays off the LAN, and
+while bound there it only answers requests whose `Host` is a loopback name
+(so a page on another site cannot reach it by re-pointing its own DNS at
+127.0.0.1). Inside a container it binds all interfaces instead, because the
+port mapping is the boundary there (`deploy-starter/` publishes to
+localhost, and its traefik override adds basic-auth). `KRAFTWERK_UI_HOST`
+overrides the default either way. A reverse proxy in front of it must set
+`X-Forwarded-Host` to the host the browser addressed (Caddy and traefik do
+by default; nginx needs `proxy_set_header X-Forwarded-Host $host;`): the
+loopback bind answers a non-loopback `Host` only when that header is
+present, and state-changing requests are refused when `Origin` names a
+different host.
+
 ### The kraftwerk.yml project config
 
 Optional, at the project root, and also the root marker for the walk-up. All

package/dist/config.d.ts

@@ -21,12 +21,34 @@
  *     - name: other space
  *       url: https://localhost:1985
  *       icon: "🛰"              # optional emoji shown next to the entry
+ *   git:                       # workspace git sync (absent = off, bare key = on with defaults)
+ *     remote: origin
+ *     interval: 300            # seconds between background fetches
+ *     autosync: pull           # off | pull
  */
 /** Stable, versionless URL of the workflow JSON schema (editor validation). */
 export declare const SCHEMA_URL = "https://raw.githubusercontent.com/NETNODEAG/kraftwerk/main/kraftwerk/schema/workflow.schema.json";
 /** Stable, versionless URL of the kraftwerk.yml JSON schema (editor validation). */
 export declare const CONFIG_SCHEMA_URL = "https://raw.githubusercontent.com/NETNODEAG/kraftwerk/main/kraftwerk/schema/kraftwerk.schema.json";
 export declare const CONFIG_FILENAMES: string[];
+/**
+ * Git sync for the workspace. The synced paths are not configurable: they
+ * are the roots this file already declares (workflows, knowledge, agents,
+ * skills) plus kraftwerk.yml itself. Commit and push stay manual; the
+ * interval only fetches, and pulls when `autosync` allows it.
+ */
+export interface GitConfig {
+    /** false keeps the block but turns the feature off. Default: true. */
+    enabled?: boolean;
+    /** Remote to fetch, pull and push. Default: origin. */
+    remote?: string;
+    /** Branch to sync. Default: whatever is checked out. */
+    branch?: string;
+    /** Seconds between background fetches. 0 disables the timer. Default: 300. */
+    interval?: number;
+    /** off = fetch only. pull = also fast-forward when behind and clean. Default: pull. */
+    autosync?: "off" | "pull";
+}
 /** One entry of the workspace switcher: another kraftwerk instance to link to. */
 export interface SwitcherEntry {
     /** Display name of the other workspace. */
@@ -55,6 +77,8 @@ export interface ProjectConfig {
     skills?: string;
     /** Other kraftwerk workspaces, shown as a switcher dropdown in the inspector header. */
     switcher?: SwitcherEntry[];
+    /** Workspace git sync. Absent = off. */
+    git?: GitConfig;
 }
 export interface Project {
     /** Absolute project root the CLI operates on. */

package/dist/config.js

@@ -24,6 +24,10 @@ import { parse } from "yaml";
  *     - name: other space
  *       url: https://localhost:1985
  *       icon: "🛰"              # optional emoji shown next to the entry
+ *   git:                       # workspace git sync (absent = off, bare key = on with defaults)
+ *     remote: origin
+ *     interval: 300            # seconds between background fetches
+ *     autosync: pull           # off | pull
  */
 /** Stable, versionless URL of the workflow JSON schema (editor validation). */
 export const SCHEMA_URL = "https://raw.githubusercontent.com/NETNODEAG/kraftwerk/main/kraftwerk/schema/workflow.schema.json";
@@ -83,6 +87,7 @@ export async function resolveProject(cwd) {
     const root = gitFallback ?? start;
     return { root, config: {}, outputDir: path.join(root, "output") };
 }
+const KNOWN_KEYS = ["name", "icon", "port", "workflows", "output", "knowledge", "agents", "skills", "switcher", "git"];
 async function loadConfig(configPath) {
     let raw;
     try {
@@ -94,10 +99,10 @@ async function loadConfig(configPath) {
     if (raw === null || raw === undefined)
         return {};
     if (typeof raw !== "object" || Array.isArray(raw)) {
-        throw new Error(`${path.basename(configPath)}: expected a mapping (name, icon, port, workflows, output, knowledge, agents, skills, switcher)`);
+        throw new Error(`${path.basename(configPath)}: expected a mapping (${KNOWN_KEYS.join(", ")})`);
     }
     const config = raw;
-    const known = ["name", "icon", "port", "workflows", "output", "knowledge", "agents", "skills", "switcher"];
+    const known = KNOWN_KEYS;
     for (const key of Object.keys(config)) {
         if (!known.includes(key)) {
             throw new Error(`${path.basename(configPath)}: unknown key "${key}" (allowed: ${known.join(", ")})`);
@@ -110,6 +115,14 @@ async function loadConfig(configPath) {
         else if (key === "switcher") {
             validateSwitcher(configPath, config[key]);
         }
+        else if (key === "git") {
+            // A bare `git:` line parses as null. Every field has a default, so read
+            // it as "on, with defaults" instead of failing the whole config load
+            // and taking the rest of the inspector down with it.
+            if (config[key] === null)
+                config[key] = {};
+            validateGit(configPath, config[key]);
+        }
         else if (typeof config[key] !== "string") {
             throw new Error(`${path.basename(configPath)}: ${key} must be a string`);
         }
@@ -142,3 +155,30 @@ function validateSwitcher(configPath, value) {
         }
     });
 }
+function validateGit(configPath, value) {
+    const file = path.basename(configPath);
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${file}: git must be a mapping (enabled, remote, branch, interval, autosync)`);
+    }
+    const g = value;
+    const known = ["enabled", "remote", "branch", "interval", "autosync"];
+    for (const key of Object.keys(g)) {
+        if (!known.includes(key)) {
+            throw new Error(`${file}: git.${key} is unknown (allowed: ${known.join(", ")})`);
+        }
+    }
+    if (g.enabled !== undefined && typeof g.enabled !== "boolean") {
+        throw new Error(`${file}: git.enabled must be true or false`);
+    }
+    for (const key of ["remote", "branch"]) {
+        if (g[key] !== undefined && (typeof g[key] !== "string" || !g[key].trim())) {
+            throw new Error(`${file}: git.${key} must be a non-empty string`);
+        }
+    }
+    if (g.interval !== undefined && (typeof g.interval !== "number" || !Number.isInteger(g.interval) || g.interval < 0)) {
+        throw new Error(`${file}: git.interval must be a whole number of seconds (0 disables the timer)`);
+    }
+    if (g.autosync !== undefined && g.autosync !== "off" && g.autosync !== "pull") {
+        throw new Error(`${file}: git.autosync must be "off" or "pull"`);
+    }
+}

package/dist/inspector/git.d.ts

@@ -0,0 +1,83 @@
+export interface GitFile {
+    /** Path relative to the repo root, which is what git speaks. */
+    path: string;
+    /** Two-letter porcelain code, e.g. " M", "??", "A ". */
+    code: string;
+    /** Human label for the code: modified, added, deleted, renamed, untracked. */
+    status: string;
+    /** Inside a synced root and not denied, so it can be selected. */
+    syncable: boolean;
+    /** Why it cannot be selected, when it cannot. */
+    reason?: string;
+}
+export interface GitStatus {
+    enabled: boolean;
+    /** Set when the feature is on but the repo cannot be used. */
+    error?: string;
+    repoRoot?: string;
+    branch?: string;
+    /** Configured or inferred upstream, absent when the branch tracks nothing. */
+    upstream?: string;
+    remote?: string;
+    ahead?: number;
+    behind?: number;
+    /** True when the branches have diverged, which needs a terminal. */
+    diverged?: boolean;
+    files?: GitFile[];
+    /** Blocked entries left out of `files` because the list was capped. */
+    blockedHidden?: number;
+    /** Repo-relative roots that may be committed. */
+    scope?: string[];
+    autosync?: "off" | "pull";
+    interval?: number;
+    lastFetch?: string;
+    lastPull?: string;
+    lastError?: string;
+}
+export interface GitDiff {
+    diff: string;
+    error?: string;
+    /** The diff was cut at MAX_DIFF; the rest is available in a terminal. */
+    truncated?: boolean;
+}
+/**
+ * Everything the git screen renders. Each call shells out to git a handful
+ * of times, and the nav badge polls it from every open tab, so results are
+ * cached for a beat.
+ */
+export declare function gitStatus(fresh?: boolean): Promise<GitStatus>;
+/**
+ * Unified diff for one changed file. Reading is as sensitive as writing
+ * here: this endpoint has no auth of its own, and a diff of an untracked
+ * .env is the file itself. So the status list is the one source of readable
+ * paths: a file not listed there, or listed as blocked, is not shown.
+ * Status never lists ignored files, which covers .gitignore too.
+ */
+export declare function gitDiff(file: string): Promise<GitDiff>;
+/** Stage the given repo-relative paths and commit just those. */
+export declare function gitCommit(paths: string[], message: string): Promise<{
+    ok: boolean;
+    error?: string;
+    committed?: number;
+}>;
+export declare function gitFetch(): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+/** Fast-forward only. A diverged branch is the user's problem, not ours. */
+export declare function gitPull(): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+export declare function gitPush(): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+/**
+ * Fetch on an interval, and fast-forward when `autosync: pull` is set. Never
+ * commits. A pull is skipped while the tree is dirty, so nobody's unsaved
+ * work is disturbed by a background merge. Ticks are chained, not scheduled
+ * on a fixed interval: a fetch against a slow remote must finish (or time
+ * out) before the next one starts, or a short interval piles up processes.
+ */
+export declare function startGitSync(): void;