@netnodeag/kraftwerk 0.68.0 → 0.69.0

package/README.md

@@ -95,13 +95,18 @@ you when it opens.
 `kraftwerk ui` hands the workspace to the daemon whenever one is running;
 `kraftwerk ui --standalone` starts a server of its own anyway.
 
-**From your phone or another computer.** Add `--lan` (`kraftwerk ui --lan`,
-or `kraftwerk daemon --lan`) and kraftwerk also listens on your network.
-Anyone who opens it there gets a pairing screen, nothing else, until you
-pair that device: `kraftwerk devices pair` on this machine prints a
-one-time code. A paired device reaches the daemon's workspaces at
-`/w/<slug>/` on the address it used, and the workspace menu links them
-that way (see [Inspector on your phone](#inspector-on-your-phone-paired-devices)).
+**From your phone or another computer** on the same network:
+
+1. Let the daemon listen on your network: `kraftwerk daemon install --lan`
+   (or run `kraftwerk daemon --lan`). It prints the address, for example
+   `http://192.168.1.20:1980`.
+2. Open that address on the phone. It shows a pairing form, nothing else.
+3. On this computer, run `kraftwerk devices pair` (or settings → devices →
+   pair a device) and type the code on the phone.
+
+The phone now sees your workspaces, each at `/w/<slug>/` on that address,
+and the workspace menu switches between them. One pairing covers all of them
+(see [Inspector on your phone](#inspector-on-your-phone-paired-devices)).
 
 **What to do first in the inspector.** Talk to **Ralv**, the workspace's
 general chat, in plain words: it knows what is in the workspace and helps
@@ -231,7 +236,7 @@ kraftwerk runs                          # past runs from output/*/trace.jsonl; r
 kraftwerk knowledge                     # Knowledge: OKF bundles (list/get/put/verify/search/...)
 kraftwerk ui                            # start this workspace: http://localhost:1981 (or open it in the daemon); --port, --lan, --standalone
 kraftwerk daemon                        # one kraftwerk for every open workspace: http://<slug>.localhost:1980; --port, --lan
-kraftwerk daemon install                # start the daemon at login (macOS LaunchAgent); `daemon uninstall` removes it
+kraftwerk daemon install                # start the daemon at login (macOS LaunchAgent); --lan, --port; `daemon uninstall` removes it
 kraftwerk workspaces                    # every workspace on this machine; workspaces start|stop|forget <ref>
 kraftwerk devices                       # paired devices (a phone, another computer); devices pair|revoke
 kraftwerk projects                      # goal-scoped project folders; projects create|show|link|log|remove
@@ -384,13 +389,15 @@ follows to author the workflow folder and validate and smoke it with this CLI.
 
 ### Inspector on your phone (paired devices)
 
-`kraftwerk ui --lan` (or `kraftwerk daemon --lan`) also listens on your
-network and prints the addresses (for example `http://192.168.1.20:1981`).
-On the daemon, a device opens a workspace at `/w/<slug>/` on that address
+`kraftwerk ui --lan` (or `kraftwerk daemon --lan`, `kraftwerk daemon install
+--lan` for the login item) also listens on your network and prints the
+addresses (for example `http://192.168.1.20:1981`). On the daemon, a device
+opens a workspace at `/w/<slug>/` on that address
 (`http://192.168.1.20:1980/w/team-blau/`), because `<slug>.localhost` only
-works on this machine. The daemon's own address lists them, and the
-workspace menu links the others the same way. Anyone who opens one gets a
-pairing screen, nothing else. To let a device in, make a one-time code on
+works on this machine. The daemon's own address lists them once the device
+is paired, and pairs it when it is not, and the workspace menu links the
+others the same way. Anyone who opens one gets a pairing screen, nothing
+else. To let a device in, make a one-time code on
 the machine kraftwerk runs on, with `kraftwerk devices pair` or settings →
 devices → pair a device, and enter it on the device. The code works once,
 for 10 minutes. The device stays paired until you unpair it in the same

package/dist/cli/daemon-login.d.ts

@@ -12,6 +12,7 @@ export declare const LAUNCH_LABEL = "ch.netnode.kraftwerk.daemon";
 export declare function renderPlist(program: string[], env: Record<string, string>, log: string): string;
 export declare function installDaemon(opts: {
     port?: string;
+    lan?: boolean;
 }): Promise<void>;
 export declare function uninstallDaemon(): Promise<void>;
 /** For doctor: whether the login item is installed. */

package/dist/cli/daemon-login.js

@@ -62,7 +62,7 @@ function requireMac() {
 }
 export async function installDaemon(opts) {
     requireMac();
-    const { cmd, args } = selfCommand(["daemon", ...(opts.port ? ["--port", opts.port] : [])]);
+    const { cmd, args } = selfCommand(["daemon", ...(opts.port ? ["--port", opts.port] : []), ...(opts.lan ? ["--lan"] : [])]);
     const env = { PATH: process.env.PATH ?? "/usr/bin:/bin" };
     if (process.env.KRAFTWERK_DAEMON_PORT && !opts.port)
         env.KRAFTWERK_DAEMON_PORT = process.env.KRAFTWERK_DAEMON_PORT;
@@ -86,6 +86,8 @@ export async function installDaemon(opts) {
         process.exit(1);
     }
     console.log(`${chalk.green("✔")} login item installed and started: ${chalk.dim(tildify(file))}`);
+    if (opts.lan)
+        console.log(chalk.dim("  on your network too: devices pair first (`kraftwerk devices pair`)"));
     console.log(chalk.dim(`  log: ${tildify(logPath())} · \`kraftwerk daemon uninstall\` removes it`));
 }
 export async function uninstallDaemon() {

package/dist/cli/daemon.js

@@ -62,9 +62,11 @@ export function registerDaemonCommand(program) {
         .command("install")
         .description("Start the daemon at login (macOS LaunchAgent), and now unless one runs")
         .option("--port <port>", `Port (default: KRAFTWERK_DAEMON_PORT, else ${DAEMON_PORT})`)
+        .option("--lan", "Listen on the network too, for paired devices (a phone on the same Wi-Fi)")
         .action(async (opts) => {
-        // `--port` after `install` is taken by `daemon` itself, which has the same option.
-        await installDaemon({ port: opts.port ?? daemon.opts().port });
+        // `--port`/`--lan` after `install` are taken by `daemon` itself, which has the same options.
+        const parent = daemon.opts();
+        await installDaemon({ port: opts.port ?? parent.port, lan: opts.lan ?? parent.lan });
     });
     daemon
         .command("uninstall")

package/dist/server/server.js

@@ -169,8 +169,8 @@ function installExitHandlers() {
     });
 }
 /**
- * Listen on `port`. On the default bind (127.0.0.1) the same port on ::1
- * feeds the same server: macOS resolves localhost and <slug>.localhost to
+ * Listen on `port`. On the default bind (127.0.0.1), and on 0.0.0.0
+ * (`--lan`, IPv4 only), the same port on ::1 feeds the same server: macOS resolves localhost and <slug>.localhost to
  * ::1 first, and a client that does not fall back to IPv4 (a native app's
  * HTTP library) would find nothing there. Best effort — without IPv6, or
  * with ::1:port taken, it stays IPv4 only, as before.
@@ -184,7 +184,7 @@ async function listen(server, port) {
             resolve(typeof addr === "object" && addr ? addr.port : port);
         });
     });
-    if (INSPECTOR_HOST !== "127.0.0.1")
+    if (INSPECTOR_HOST !== "127.0.0.1" && INSPECTOR_HOST !== "0.0.0.0")
         return bound;
     const twin = net.createServer((socket) => server.emit("connection", socket));
     const ok = await new Promise((resolve) => {
@@ -205,18 +205,35 @@ async function listen(server, port) {
 /**
  * A small page at a daemon's own address: the open workspaces, each a link —
  * <slug>.localhost on this machine, the path form on the address a paired
- * device used (it cannot resolve <slug>.localhost).
+ * device used (it cannot resolve <slug>.localhost). A device that is not
+ * paired yet gets a pairing form instead, and no workspace names: the code
+ * comes from this machine (`kraftwerk devices pair`), and the cookie it earns
+ * covers every workspace on this address.
  */
-function hubPage(req, res, open) {
+function hubPage(req, res, open, trust) {
     const esc = (s) => s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
     // Behind a proxy on this machine the browser's name is the forwarded one.
     const host = hostnameOf(forwardedHost(req) ?? req.headers.host ?? "");
     const local = LOOPBACK_NAMES.has(host) || host.endsWith(".localhost");
+    const head = `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>kraftwerk</title>` +
+        `<style>:root{color-scheme:light dark}body{font:16px/1.6 system-ui,sans-serif;max-width:560px;margin:40px auto;padding:0 16px}` +
+        `code{opacity:.7;font-size:13px}ul{list-style:none;padding:0}li{border-bottom:1px solid #8884}li a{display:block;padding:12px 0;font-weight:600;text-decoration:none;color:inherit}` +
+        `input,button{font:inherit;padding:10px 12px;border-radius:10px;border:1px solid #8888;width:100%;box-sizing:border-box;margin:6px 0}` +
+        `input[name=code]{letter-spacing:.2em;text-transform:uppercase}button{background:#5b4bd5;color:#fff;border:0;font-weight:600}#err{color:#c62828}</style><h1>kraftwerk</h1>`;
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+    if (trust.kind === "none") {
+        return void res.end(head +
+            `<p>Pair this device to use kraftwerk on this computer. On the computer, run <code>kraftwerk devices pair</code> (or settings → devices → pair a device) and enter the code here.</p>` +
+            `<form id="pair"><input name="code" placeholder="code" autocomplete="one-time-code" autocapitalize="characters" required>` +
+            `<input name="name" placeholder="this device's name, e.g. Lukas' iPhone"><button>pair</button><p id="err"></p></form>` +
+            `<script>document.getElementById("pair").onsubmit=async(e)=>{e.preventDefault();const f=new FormData(e.target);` +
+            `const r=await fetch("/api/pair",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({code:String(f.get("code")).trim(),name:String(f.get("name")||navigator.platform||"device")})});` +
+            `if(r.ok)location.reload();else document.getElementById("err").textContent=(await r.json().catch(()=>({}))).error||"pairing failed"}</script>`);
+    }
     const rows = open.length
-        ? open.map((o) => `<li><a href="${esc(local ? `${o.url}/` : `/w/${o.slug}/`)}">${esc(o.name)}</a> <code>${esc(o.slug)}</code></li>`).join("")
+        ? open.map((o) => `<li><a href="${esc(local ? `${o.url}/` : `/w/${o.slug}/`)}">${esc(o.name)} <code>${esc(o.slug)}</code></a></li>`).join("")
         : "<li>No workspace is open. Run <code>kraftwerk ui</code> in a workspace folder.</li>";
-    res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
-    res.end(`<!doctype html><meta charset="utf-8"><title>kraftwerk</title><style>body{font:15px/1.6 system-ui,sans-serif;max-width:640px;margin:48px auto;padding:0 16px;color:#1b1b1f}code{color:#46464f}</style><h1>kraftwerk</h1><ul>${rows}</ul>`);
+    res.end(`${head}<ul>${rows}</ul>`);
 }
 export async function startHub(opts) {
     const trustOpts = { trustLoopback: opts.trustLoopback !== false && !REQUIRE_PAIRING, trustNetwork: TRUST_NETWORK };
@@ -260,7 +277,7 @@ export async function startHub(opts) {
             }
             // A daemon's own address lists its workspaces; anywhere else, the web UI's shell (public: an unpaired browser needs it to pair).
             if (!open && (url.pathname === "/" || url.pathname === "/index.html"))
-                return hubPage(req, res, [...bySlug.values()]);
+                return hubPage(req, res, [...bySlug.values()], trust);
             await serveStatic(res, opts.staticDir, url.pathname);
         }
         catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netnodeag/kraftwerk",
-  "version": "0.68.0",
+  "version": "0.69.0",
   "description": "Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification",
   "keywords": [
     "agents",