@oscharko-dev/keiko 0.1.6 → 0.1.7

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/run-handlers.js

@@ -0,0 +1,441 @@
+// The five run-engine BFF endpoints (ADR-0011 D5 routes 5–9). POST /api/runs starts a dry-run-first
+// run in the background and returns 202 {runId, fingerprint}; the SSE route replays the bounded ring
+// buffer (respecting Last-Event-ID) then streams live redacted events, closing after the terminal
+// event; cancel propagates to the underlying harness/workflow AbortController; GET returns the
+// redacted final report projection (or status:"running"); apply is the ONLY write path, re-invoking
+// the same workflow with apply:true through the existing gated path. No model is ever called
+// directly; no guard is reimplemented; no secret reaches any response (live payloads are redacted).
+import { randomUUID } from "node:crypto";
+import { parseRunRequest } from "./run-request.js";
+import { startRun, applyRun } from "./run-engine.js";
+import { ActiveRunLimitError } from "./runs.js";
+import { SSE_HEADERS, writeEvent, readyMessage } from "./sse.js";
+import { errorBody, STREAMING } from "./routes.js";
+import { currentRedactionSecrets } from "./deps.js";
+import { UiStoreError } from "./store/index.js";
+const MAX_BODY_BYTES = 1_000_000;
+const VERIFY_NOOP_MODEL = {
+    call: () => Promise.reject(new Error("verify runs must not call the model")),
+};
+// Sentinel thrown (and caught in handleCreateRun) when the body exceeds MAX_BODY_BYTES. Using a
+// typed class avoids fragile string matching and clearly separates this case from I/O errors.
+class BodyTooLargeError extends Error {
+    constructor() {
+        super("request body too large");
+        this.name = "BodyTooLargeError";
+    }
+}
+// Reads the request body up to a byte cap (a bounded read protects the loopback BFF from an
+// oversized body). Resolves the decoded UTF-8 text, or rejects with BodyTooLargeError past the cap.
+// When the cap is exceeded the stream is switched to flowing/drain mode (req.resume) so Node.js
+// continues consuming the socket data and the HTTP server can still write the 413 response over
+// the same connection (FIX H). The chunks array is cleared at that point to free accumulated memory.
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        let capped = false;
+        req.on("data", (chunk) => {
+            total += chunk.length;
+            if (total > MAX_BODY_BYTES) {
+                if (!capped) {
+                    capped = true;
+                    chunks.length = 0; // release accumulated buffers before draining
+                    reject(new BodyTooLargeError());
+                    req.resume(); // drain without buffering; lets the server write the 413 response
+                }
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            if (!capped) {
+                resolve(Buffer.concat(chunks).toString("utf8"));
+            }
+        });
+        req.on("error", reject);
+    });
+}
+// Composer-launched runs operate on the host filesystem. Reject workspaceRoot paths not registered
+// in the local project store so a CSRF-equipped local client cannot trigger workflows in arbitrary
+// directories. Returns a RouteResult to return, or null when the check passes.
+function rejectUnregisteredWorkspace(parsed, deps) {
+    const root = typeof parsed.input.workspaceRoot === "string" ? parsed.input.workspaceRoot : "";
+    const registered = deps.store.listProjects().some((p) => p.path === root);
+    return registered
+        ? null
+        : {
+            status: 403,
+            body: errorBody("WORKSPACE_NOT_REGISTERED", "The workspaceRoot is not a registered project."),
+        };
+}
+function resolveRunModel(parsed, deps) {
+    return parsed.kind === "verify" ? VERIFY_NOOP_MODEL : deps.modelPortFactory(parsed.modelId);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireBodyString(body, name) {
+    const value = body[name];
+    if (typeof value !== "string" || value.length === 0) {
+        return { status: 400, body: errorBody("BAD_REQUEST", `Field "${name}" is required.`) };
+    }
+    return value;
+}
+function requireBodyNumber(body, name) {
+    const value = body[name];
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        return {
+            status: 400,
+            body: errorBody("BAD_REQUEST", `Field "${name}" must be a finite number.`),
+        };
+    }
+    return value;
+}
+function requireBodyRecord(body, name) {
+    const value = body[name];
+    if (!isRecord(value)) {
+        return { status: 400, body: errorBody("BAD_REQUEST", `Field "${name}" must be an object.`) };
+    }
+    return value;
+}
+function parseJsonRecord(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { status: 400, body: errorBody("BAD_REQUEST", "Request body is not valid JSON.") };
+    }
+    if (!isRecord(parsed)) {
+        return { status: 400, body: errorBody("BAD_REQUEST", "Request body must be a JSON object.") };
+    }
+    return parsed;
+}
+function isRouteResult(value) {
+    return isRecord(value) && typeof value.status === "number" && "body" in value;
+}
+function chatBelongsToProject(deps, projectPath, chatId) {
+    return deps.store.listChats(projectPath).some((chat) => chat.id === chatId);
+}
+function runSummaryDiscriminator(request) {
+    if (request.kind === "unit-tests") {
+        return { workflowId: "unit-test-generation", taskType: undefined };
+    }
+    if (request.kind === "bug-investigation") {
+        return { workflowId: "bug-investigation", taskType: undefined };
+    }
+    if (request.kind === "explain-plan") {
+        return { workflowId: undefined, taskType: "explain-plan" };
+    }
+    return { workflowId: undefined, taskType: "verify" };
+}
+function buildChatRunMessages(body, request, chatId, runId) {
+    const user = requireBodyRecord(body, "user");
+    if (isRouteResult(user))
+        return user;
+    const summary = requireBodyRecord(body, "summary");
+    if (isRouteResult(summary))
+        return summary;
+    const userContent = requireBodyString(user, "content");
+    if (typeof userContent !== "string")
+        return userContent;
+    const userTimestamp = requireBodyNumber(user, "timestamp");
+    if (typeof userTimestamp !== "number")
+        return userTimestamp;
+    const summaryContent = requireBodyString(summary, "content");
+    if (typeof summaryContent !== "string")
+        return summaryContent;
+    const summaryTimestamp = requireBodyNumber(summary, "timestamp");
+    if (typeof summaryTimestamp !== "number")
+        return summaryTimestamp;
+    const discriminator = runSummaryDiscriminator(request);
+    return [
+        {
+            chatId,
+            role: "user",
+            content: userContent,
+            timestamp: userTimestamp,
+            runId: undefined,
+            workflowId: undefined,
+            workflowStatus: undefined,
+            shortResult: undefined,
+            taskType: undefined,
+        },
+        {
+            chatId,
+            role: "system",
+            content: summaryContent,
+            timestamp: summaryTimestamp,
+            runId,
+            workflowId: discriminator.workflowId,
+            workflowStatus: "running",
+            shortResult: undefined,
+            taskType: discriminator.taskType,
+        },
+    ];
+}
+function storeErrorResult(error) {
+    return { status: error.status, body: errorBody(error.code, error.message) };
+}
+function markSummaryFailed(deps, message, shortResult) {
+    try {
+        deps.store.updateMessage(message.id, { workflowStatus: "failed", shortResult });
+    }
+    catch {
+        // Best-effort compensation only. The original start error remains the response source.
+    }
+}
+function parseChatRunEnvelope(raw, deps) {
+    const body = parseJsonRecord(raw);
+    if (isRouteResult(body))
+        return body;
+    const chatId = requireBodyString(body, "chatId");
+    if (isRouteResult(chatId))
+        return chatId;
+    const projectPath = requireBodyString(body, "projectPath");
+    if (isRouteResult(projectPath))
+        return projectPath;
+    if (!chatBelongsToProject(deps, projectPath, chatId)) {
+        return { status: 404, body: errorBody("NOT_FOUND", "Chat not found.") };
+    }
+    const runBody = requireBodyRecord(body, "run");
+    if (isRouteResult(runBody))
+        return runBody;
+    return { body, chatId, projectPath, runBody };
+}
+function validateChatRunRequest(runBody, deps) {
+    const parsed = parseRunRequest(JSON.stringify(runBody));
+    if ("code" in parsed) {
+        return { status: 400, body: errorBody(parsed.code, parsed.message) };
+    }
+    const unregistered = rejectUnregisteredWorkspace(parsed, deps);
+    if (unregistered !== null)
+        return unregistered;
+    const model = resolveRunModel(parsed, deps);
+    return model === undefined
+        ? { status: 400, body: errorBody("NO_MODEL", "No model provider is configured.") }
+        : { request: parsed, model };
+}
+function engineContextFor(deps, request, model) {
+    return {
+        request,
+        model,
+        registry: deps.registry,
+        evidence: {
+            store: deps.evidenceStore,
+            env: deps.env,
+            additionalSecrets: currentRedactionSecrets(deps),
+        },
+    };
+}
+function persistChatRunMessages(deps, envelope, request, runId) {
+    const messagesInput = buildChatRunMessages(envelope.body, request, envelope.chatId, runId);
+    if (isRouteResult(messagesInput))
+        return messagesInput;
+    try {
+        return deps.store.createMessages(messagesInput);
+    }
+    catch (error) {
+        if (error instanceof UiStoreError)
+            return storeErrorResult(error);
+        throw error;
+    }
+}
+function startPersistedChatRun(deps, request, model, runId, messages) {
+    try {
+        const run = startRun(engineContextFor(deps, request, model), deps.redactor, { runId });
+        return { status: 202, body: { run, messages } };
+    }
+    catch (error) {
+        const summary = messages[1];
+        if (summary !== undefined) {
+            markSummaryFailed(deps, summary, "Run could not be started.");
+        }
+        if (error instanceof ActiveRunLimitError) {
+            return { status: 429, body: errorBody("TOO_MANY_RUNS", "The active run limit is reached.") };
+        }
+        throw error;
+    }
+}
+// Route 5 — POST /api/runs. Validates the body, resolves the ModelPort, starts the run, returns 202.
+export async function handleCreateRun(ctx, deps) {
+    let raw;
+    try {
+        raw = await readBody(ctx.req);
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError) {
+            return {
+                status: 413,
+                body: errorBody("PAYLOAD_TOO_LARGE", "Request body exceeds the size limit."),
+            };
+        }
+        throw error;
+    }
+    const parsed = parseRunRequest(raw);
+    if ("code" in parsed) {
+        return { status: 400, body: errorBody(parsed.code, parsed.message) };
+    }
+    const unregistered = rejectUnregisteredWorkspace(parsed, deps);
+    if (unregistered !== null) {
+        return unregistered;
+    }
+    const model = resolveRunModel(parsed, deps);
+    if (model === undefined) {
+        return { status: 400, body: errorBody("NO_MODEL", "No model provider is configured.") };
+    }
+    const engineCtx = {
+        request: parsed,
+        model,
+        registry: deps.registry,
+        evidence: {
+            store: deps.evidenceStore,
+            env: deps.env,
+            additionalSecrets: currentRedactionSecrets(deps),
+        },
+    };
+    try {
+        const started = startRun(engineCtx, deps.redactor);
+        return { status: 202, body: { runId: started.runId, fingerprint: started.fingerprint } };
+    }
+    catch (error) {
+        if (error instanceof ActiveRunLimitError) {
+            return { status: 429, body: errorBody("TOO_MANY_RUNS", "The active run limit is reached.") };
+        }
+        throw error;
+    }
+}
+// Route — POST /api/chats/runs. Composer-specific path that makes Issue #66's chat invariant
+// explicit: a successful workflow launch first reserves a runId and persists exactly one user
+// message plus one system run summary, then starts the run with that reserved runId. If persistence
+// fails, no run is started; if the start is refused, the summary is terminalized as failed.
+export async function handleCreateChatRun(ctx, deps) {
+    let raw;
+    try {
+        raw = await readBody(ctx.req);
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError) {
+            return {
+                status: 413,
+                body: errorBody("PAYLOAD_TOO_LARGE", "Request body exceeds the size limit."),
+            };
+        }
+        throw error;
+    }
+    const envelope = parseChatRunEnvelope(raw, deps);
+    if (isRouteResult(envelope))
+        return envelope;
+    const validated = validateChatRunRequest(envelope.runBody, deps);
+    if (isRouteResult(validated))
+        return validated;
+    const runId = randomUUID();
+    const messages = persistChatRunMessages(deps, envelope, validated.request, runId);
+    if (isRouteResult(messages))
+        return messages;
+    return startPersistedChatRun(deps, validated.request, validated.model, runId, messages);
+}
+function lastEventId(req) {
+    const header = req.headers["last-event-id"];
+    const value = Array.isArray(header) ? header[0] : header;
+    if (value === undefined) {
+        return -1;
+    }
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) ? parsed : -1;
+}
+// Route 6 — GET /api/runs/:runId/events (SSE). Replays the ring buffer (after Last-Event-ID), sends
+// `ready`, then streams live events, closing after the run terminates. The writer is detached on
+// client disconnect to avoid leaks and unbounded fan-out.
+export function handleRunEvents(ctx, deps) {
+    const record = deps.registry.get(ctx.params.runId ?? "");
+    if (record === undefined) {
+        return { status: 404, body: errorBody("NOT_FOUND", "Unknown run.") };
+    }
+    openSseStream(ctx.res, record, lastEventId(ctx.req), deps.redactor);
+    ctx.req.on("close", () => {
+        ctx.res.end();
+    });
+    return STREAMING;
+}
+function openSseStream(res, record, afterSeq, redactor) {
+    res.writeHead(200, SSE_HEADERS);
+    const writer = {
+        write: (event) => {
+            const accepted = writeEvent(res, event, redactor);
+            if (!accepted) {
+                res.destroy();
+            }
+            return accepted;
+        },
+        close: () => {
+            res.end();
+        },
+    };
+    const detach = record.sink.attach(writer, afterSeq);
+    res.write(readyMessage());
+    res.on("close", detach);
+    if (record.sink.isTerminated()) {
+        detach();
+        res.end();
+    }
+}
+// Route 7 — POST /api/runs/:runId/cancel. Idempotent; 404 unknown.
+export function handleCancelRun(ctx, deps) {
+    const record = deps.registry.get(ctx.params.runId ?? "");
+    if (record === undefined) {
+        return { status: 404, body: errorBody("NOT_FOUND", "Unknown run.") };
+    }
+    record.cancel("cancelled via UI");
+    return { status: 200, body: { ok: true } };
+}
+// Route 8 — GET /api/runs/:runId. Final redacted report projection, or status:"running".
+export function handleGetRun(ctx, deps) {
+    const record = deps.registry.get(ctx.params.runId ?? "");
+    if (record === undefined) {
+        return { status: 404, body: errorBody("NOT_FOUND", "Unknown run.") };
+    }
+    if (record.status === "running") {
+        return { status: 200, body: { report: { status: "running" } } };
+    }
+    return {
+        status: 200,
+        body: { report: reportWithApply(record.report, record.applyReport, record.appliedAt) },
+    };
+}
+function reportWithApply(report, applyReport, appliedAt) {
+    if (applyReport === undefined || appliedAt === undefined) {
+        return report;
+    }
+    if (!isRecord(report)) {
+        return { report, applyReport, appliedAt };
+    }
+    return { ...report, applyReport, appliedAt };
+}
+// Route 9 — POST /api/runs/:runId/apply. The ONLY write path. 404 unknown; 409 when not in an
+// appliable (dry-run-success) state; otherwise re-invokes the gated workflow with apply:true.
+export async function handleApplyRun(ctx, deps) {
+    const record = deps.registry.get(ctx.params.runId ?? "");
+    if (record === undefined) {
+        return { status: 404, body: errorBody("NOT_FOUND", "Unknown run.") };
+    }
+    if (record.appliable === undefined) {
+        return {
+            status: 409,
+            body: errorBody("NOT_APPLIABLE", "The run is not in an appliable state."),
+        };
+    }
+    const model = deps.modelPortFactory(record.modelId);
+    if (model === undefined) {
+        return { status: 400, body: errorBody("NO_MODEL", "No model provider is configured.") };
+    }
+    const report = await applyRun(record.appliable, model, record.modelId, deps.redactor);
+    record.appliable = undefined;
+    record.applyReport = report;
+    record.appliedAt = Date.now();
+    return {
+        status: 200,
+        body: { report: reportWithApply(record.report, record.applyReport, record.appliedAt) },
+    };
+}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/run-request.d.ts

@@ -0,0 +1,14 @@
+export type RunKind = "unit-tests" | "bug-investigation" | "explain-plan" | "verify";
+export interface RunRequest {
+    readonly kind: RunKind;
+    readonly modelId: string;
+    readonly apply: boolean;
+    readonly input: Record<string, unknown>;
+    readonly limits: Record<string, unknown> | undefined;
+}
+export interface RunRequestError {
+    readonly code: "BAD_REQUEST";
+    readonly message: string;
+}
+export declare function parseRunRequest(raw: string): RunRequest | RunRequestError;
+//# sourceMappingURL=run-request.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/run-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-request.d.ts","sourceRoot":"","sources":["../../../../src/run-request.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAErF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAExB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAExC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AA4ND,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,eAAe,CAsCzE"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/runs.d.ts

@@ -0,0 +1,44 @@
+import type { QueueEventSink } from "./sink.js";
+export type RunStatus = "running" | "completed" | "cancelled" | "failed";
+export interface AppliableSnapshot {
+    readonly kind: "unit-tests" | "bug-investigation";
+    readonly payload: unknown;
+    readonly limits: Record<string, unknown> | undefined;
+}
+export interface RunRecord {
+    readonly runId: string;
+    readonly fingerprint: string;
+    readonly modelId: string;
+    readonly sink: QueueEventSink;
+    status: RunStatus;
+    report: unknown;
+    readonly cancel: (reason?: string) => void;
+    appliable: AppliableSnapshot | undefined;
+    applyReport: unknown;
+    appliedAt: number | undefined;
+    terminatedAt: number | undefined;
+}
+export interface RegisterRunInput {
+    readonly runId: string;
+    readonly fingerprint: string;
+    readonly modelId: string;
+    readonly sink: QueueEventSink;
+    readonly cancel: (reason?: string) => void;
+}
+export interface RunRegistryOptions {
+    readonly maxActiveRuns?: number | undefined;
+    readonly terminatedTtlMs?: number | undefined;
+    readonly now?: (() => number) | undefined;
+}
+export declare class ActiveRunLimitError extends Error {
+    constructor(limit: number);
+}
+export interface RunRegistry {
+    register: (input: RegisterRunInput) => RunRecord;
+    get: (runId: string) => RunRecord | undefined;
+    complete: (runId: string, status: Exclude<RunStatus, "running">, report: unknown, appliable: AppliableSnapshot | undefined) => void;
+    activeCount: () => number;
+    size: () => number;
+}
+export declare function createRunRegistry(options?: RunRegistryOptions): RunRegistry;
+//# sourceMappingURL=runs.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/runs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs.d.ts","sourceRoot":"","sources":["../../../../src/runs.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAMzE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,mBAAmB,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAG7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,MAAM,EAAE,SAAS,CAAC;IAElB,MAAM,EAAE,OAAO,CAAC;IAEhB,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAE3C,SAAS,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAEzC,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,KAAK,EAAE,MAAM;CAI1B;AAKD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,SAAS,CAAC;IACjD,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAE9C,QAAQ,EAAE,CACR,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EACrC,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,iBAAiB,GAAG,SAAS,KACrC,IAAI,CAAC;IAEV,WAAW,EAAE,MAAM,MAAM,CAAC;IAE1B,IAAI,EAAE,MAAM,MAAM,CAAC;CACpB;AAuED,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CAyB/E"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/server.d.ts

@@ -0,0 +1,12 @@
+import { type Server } from "node:http";
+import { type UiHandlerDeps } from "./deps.js";
+export declare const DEFAULT_UI_PORT = 1983;
+export declare const UI_HOST = "127.0.0.1";
+export interface UiServerDeps {
+    readonly staticRoot: string;
+    readonly csp: string;
+    readonly port: number;
+    readonly handlerDeps?: UiHandlerDeps | undefined;
+}
+export declare function createUiServer(deps: UiServerDeps): Server;
+//# sourceMappingURL=server.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/server.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAejG,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAI9D,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,eAAO,MAAM,OAAO,cAAc,CAAC;AAEnC,MAAM,WAAW,YAAY;IAE3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAClD;AAuJD,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAUzD"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/server.js

@@ -0,0 +1,143 @@
+// The local UI BFF binds 127.0.0.1 only, applies security headers and CSP to every response,
+// rejects non-loopback Host/Origin headers, dispatches API routes through injected handlers,
+// and serves the static export from a contained root.
+import { createServer } from "node:http";
+import { extname, join } from "node:path";
+import { applySecurityHeaders } from "./headers.js";
+import { isAllowedHost } from "./host-check.js";
+import { resolveContainedPath, serveFile } from "./static.js";
+import { errorBody, isApiPath, matchRoute, methodNotAllowedBody, notFoundBody, STREAMING, } from "./routes.js";
+import { buildRedactor } from "./deps.js";
+import { createRunRegistry } from "./runs.js";
+import { createInMemoryUiStore } from "./store/index.js";
+export const DEFAULT_UI_PORT = 1983;
+export const UI_HOST = "127.0.0.1";
+function writeJson(res, status, body) {
+    res.statusCode = status;
+    res.setHeader("Content-Type", "application/json; charset=utf-8");
+    res.end(JSON.stringify(body));
+}
+function isJsonRequest(req) {
+    const header = req.headers["content-type"];
+    const value = typeof header === "string" ? header : header?.[0];
+    return value?.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
+}
+function hasCsrfHeader(req) {
+    const header = req.headers["x-keiko-csrf"];
+    const value = Array.isArray(header) ? header[0] : header;
+    return value === "1";
+}
+function rejectUnsupportedMediaType(res) {
+    writeJson(res, 415, errorBody("UNSUPPORTED_MEDIA_TYPE", "State-changing API requests must use JSON."));
+}
+function rejectCsrf(res) {
+    writeJson(res, 403, errorBody("FORBIDDEN_CSRF", "Missing state-changing request guard."));
+}
+// A minimal default deps object so a 3-arg server can still serve the deps-bound read routes (e.g.
+// `/api/models` and `/api/workspace`, which need no config) without a config or evidence dir. The
+// fallback UI store is in-memory: a 3-arg server is used by the Wave 1 host smoke and by tests that
+// never exercise the store routes, so an ephemeral in-memory store is the safe degraded shape.
+function fallbackDeps() {
+    return {
+        config: undefined,
+        configPresent: false,
+        evidenceStore: { put: () => "", list: () => [], get: () => undefined, delete: () => undefined },
+        env: {},
+        redactor: buildRedactor({}),
+        registry: createRunRegistry(),
+        modelPortFactory: () => undefined,
+        store: createInMemoryUiStore(),
+    };
+}
+function isStateChangingMethod(method) {
+    return method === "POST" || method === "PATCH" || method === "PUT" || method === "DELETE";
+}
+// Returns true when the request was rejected (caller should return immediately).
+function rejectIfInvalidStateChange(req, res) {
+    if (!isJsonRequest(req)) {
+        rejectUnsupportedMediaType(res);
+        return true;
+    }
+    if (!hasCsrfHeader(req)) {
+        rejectCsrf(res);
+        return true;
+    }
+    return false;
+}
+async function dispatchApi(handlerDeps, req, res, method, url) {
+    const match = matchRoute(method, url.pathname);
+    if (match === undefined) {
+        writeJson(res, 404, notFoundBody());
+        return;
+    }
+    if (match === "method-not-allowed") {
+        writeJson(res, 405, methodNotAllowedBody());
+        return;
+    }
+    if (isStateChangingMethod(method) && rejectIfInvalidStateChange(req, res)) {
+        return;
+    }
+    const ctx = { req, res, params: match.params, url };
+    const outcome = await match.definition.handler(ctx, handlerDeps);
+    if (outcome === STREAMING) {
+        return;
+    }
+    writeJson(res, outcome.status, outcome.body);
+}
+async function serveStatic(res, staticRoot, pathname) {
+    const targets = pathname === "/"
+        ? ["/index.html"]
+        : extname(pathname) === ""
+            ? [pathname, `${pathname}.html`, `${pathname}/index.html`]
+            : [pathname];
+    for (const target of targets) {
+        const resolved = resolveContainedPath(staticRoot, target);
+        if (resolved !== undefined && (await serveFile(res, resolved))) {
+            return;
+        }
+    }
+    const indexPath = join(staticRoot, "index.html");
+    if (await serveFile(res, indexPath)) {
+        return;
+    }
+    writeJson(res, 404, errorBody("NOT_FOUND", "The requested resource was not found."));
+}
+function rejectForbiddenHost(res) {
+    const body = errorBody("FORBIDDEN_HOST", "Request host is not the local interface.");
+    writeJson(res, 403, body);
+}
+function handle(deps, handlerDeps, req, res) {
+    const url = new URL(req.url ?? "/", `http://${UI_HOST}`);
+    const apiPath = isApiPath(url.pathname);
+    applySecurityHeaders(res, deps.csp, apiPath);
+    if (!isAllowedHost(req, deps.port)) {
+        rejectForbiddenHost(res);
+        return;
+    }
+    const method = (req.method ?? "GET").toUpperCase();
+    const work = apiPath
+        ? dispatchApi(handlerDeps, req, res, method, url)
+        : serveStatic(res, deps.staticRoot, url.pathname);
+    void work.catch(() => {
+        if (!res.headersSent) {
+            writeJson(res, 500, errorBody("INTERNAL", "An unexpected error occurred."));
+        }
+        else {
+            res.end();
+        }
+    });
+}
+// Creates the BFF server. The caller binds it with `server.listen(deps.port, UI_HOST)` so it never
+// listens on a non-loopback interface. The previous PTY WebSocket upgrade handler is removed —
+// the terminal tool is now bounded-exec over plain HTTP (ADR-0018 D1/D8).
+export function createUiServer(deps) {
+    const handlerDeps = deps.handlerDeps ?? fallbackDeps();
+    const server = createServer((req, res) => {
+        handle(deps, handlerDeps, req, res);
+    });
+    server.on("upgrade", (_req, socket) => {
+        socket.write("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
+        socket.destroy();
+    });
+    return server;
+}