@thxgg/steward 0.1.15 → 0.1.17

package/dist/host/src/executor.js

@@ -1,103 +1,21 @@
-import vm from 'node:vm';
-import { git, prds, repos, state } from './api/index.js';
-import { getStewardHelp } from './help.js';
-const MAX_OUTPUT_SIZE = 50_000;
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 const EXECUTION_TIMEOUT_MS = 30_000;
-const MAX_TIMERS = 100;
-const MAX_LOG_ENTRIES = 200;
-const MAX_LOG_OUTPUT_SIZE = 20_000;
-const MAX_LOG_ENTRY_SIZE = 2_000;
-export class ExecutionError extends Error {
-    options;
-    constructor(message, options) {
-        super(message);
-        this.options = options;
-        this.name = 'ExecutionError';
-    }
-}
-function safeJsonStringify(value) {
-    const seen = new WeakSet();
-    try {
-        return JSON.stringify(value, (_key, currentValue) => {
-            if (typeof currentValue === 'bigint') {
-                return `${currentValue}n`;
-            }
-            if (typeof currentValue === 'function') {
-                const functionName = currentValue.name ? ` ${currentValue.name}` : '';
-                return `[Function${functionName}]`;
-            }
-            if (typeof currentValue === 'symbol') {
-                return currentValue.toString();
-            }
-            if (typeof currentValue === 'object' && currentValue !== null) {
-                if (seen.has(currentValue)) {
-                    return '[Circular]';
-                }
-                seen.add(currentValue);
-            }
-            return currentValue;
-        });
-    }
-    catch {
-        return undefined;
-    }
-}
-function formatLogValue(value) {
-    if (typeof value === 'string') {
-        return value;
-    }
-    const json = safeJsonStringify(value);
-    if (json !== undefined) {
-        return json;
-    }
-    return String(value);
-}
-function truncateResult(result) {
-    if (result === undefined) {
-        return {
-            result: null,
-            truncatedResult: false,
-            resultWasUndefined: true
-        };
-    }
-    const json = safeJsonStringify(result);
-    if (json === undefined) {
-        return {
-            result: {
-                _unserializable: true,
-                preview: String(result)
-            },
-            truncatedResult: false,
-            resultWasUndefined: false
-        };
-    }
-    if (json.length <= MAX_OUTPUT_SIZE) {
-        return {
-            result,
-            truncatedResult: false,
-            resultWasUndefined: false
-        };
+const MAX_STDIO_CAPTURE = 200_000;
+function getForwardedNodeFlags() {
+    const forwarded = [];
+    for (const arg of process.execArgv) {
+        if (arg === '--experimental-sqlite' || arg === '--no-experimental-sqlite') {
+            forwarded.push(arg);
+            continue;
+        }
+        if (arg.startsWith('--experimental-sqlite=')) {
+            forwarded.push(arg);
+        }
     }
-    return {
-        result: {
-            _truncated: true,
-            size: json.length,
-            preview: json.slice(0, MAX_OUTPUT_SIZE),
-            message: `Output truncated (${json.length} chars, showing first ${MAX_OUTPUT_SIZE})`
-        },
-        truncatedResult: true,
-        resultWasUndefined: false
-    };
+    return forwarded;
 }
 function normalizeFailure(error) {
-    if (error instanceof ExecutionError) {
-        return {
-            code: error.options?.code || 'EXECUTION_ERROR',
-            message: error.message,
-            ...(error.options?.stackTrace && { stack: error.options.stackTrace }),
-            ...(error.options?.details !== undefined && { details: error.options.details })
-        };
-    }
     if (error instanceof Error) {
         const { code, details } = error;
         return {
@@ -112,184 +30,144 @@ function normalizeFailure(error) {
         message: String(error)
     };
 }
-export async function execute(code) {
-    const startedAt = Date.now();
-    const logs = [];
-    let totalLogChars = 0;
-    let logsTruncated = false;
-    const appendLog = (level, args) => {
-        if (logs.length >= MAX_LOG_ENTRIES) {
-            logsTruncated = true;
-            return;
-        }
-        let message = args.map(formatLogValue).join(' ');
-        if (message.length > MAX_LOG_ENTRY_SIZE) {
-            message = `${message.slice(0, MAX_LOG_ENTRY_SIZE)}...`;
-            logsTruncated = true;
-        }
-        if (totalLogChars + message.length > MAX_LOG_OUTPUT_SIZE) {
-            logsTruncated = true;
-            return;
-        }
-        totalLogChars += message.length;
-        logs.push({
-            level,
+function buildFailureEnvelope(startedAt, code, message, details) {
+    return {
+        ok: false,
+        result: null,
+        logs: [],
+        error: {
+            code,
             message,
-            timestamp: new Date().toISOString()
-        });
-    };
-    const buildEnvelope = (params) => ({
-        ok: params.ok,
-        result: params.result,
-        logs,
-        error: params.error,
+            ...(details !== undefined && { details })
+        },
         meta: {
             timeoutMs: EXECUTION_TIMEOUT_MS,
             durationMs: Date.now() - startedAt,
-            truncatedResult: params.truncatedResult,
-            truncatedLogs: logsTruncated,
-            resultWasUndefined: params.resultWasUndefined
-        }
-    });
-    if (!code || !code.trim()) {
-        const error = normalizeFailure(new ExecutionError('Code cannot be empty', { code: 'EMPTY_CODE' }));
-        return buildEnvelope({
-            ok: false,
-            result: null,
-            error,
             truncatedResult: false,
+            truncatedLogs: false,
             resultWasUndefined: false
-        });
-    }
-    const timers = new Set();
-    let executionTimeout = null;
-    let asyncCallbackError = null;
-    const wrapTimerHandler = (handler) => {
-        return () => {
-            try {
-                handler();
-            }
-            catch (error) {
-                const normalizedError = error instanceof Error
-                    ? error
-                    : new Error(String(error));
-                asyncCallbackError = normalizedError;
-                appendLog('error', ['Timer callback error:', normalizedError.message]);
-            }
-        };
+        }
     };
-    const ensureTimerHandler = (handler) => {
-        if (typeof handler !== 'function') {
-            throw new ExecutionError('Timer handler must be a function', {
-                code: 'INVALID_TIMER_HANDLER'
-            });
+}
+function withDurationFallback(envelope, startedAt) {
+    const durationMs = Number.isFinite(envelope.meta.durationMs) && envelope.meta.durationMs >= 0
+        ? envelope.meta.durationMs
+        : Date.now() - startedAt;
+    return {
+        ...envelope,
+        meta: {
+            ...envelope.meta,
+            timeoutMs: EXECUTION_TIMEOUT_MS,
+            durationMs
         }
-        return wrapTimerHandler(handler);
     };
-    const sandbox = {
-        repos,
-        prds,
-        git,
-        state,
-        steward: {
-            help: () => getStewardHelp()
-        },
-        console: {
-            log: (...args) => appendLog('log', args),
-            info: (...args) => appendLog('info', args),
-            warn: (...args) => appendLog('warn', args),
-            error: (...args) => appendLog('error', args)
-        },
-        setTimeout: (handler, timeout) => {
-            if (timers.size >= MAX_TIMERS) {
-                throw new ExecutionError(`Timer limit exceeded (max ${MAX_TIMERS})`, {
-                    code: 'TIMER_LIMIT'
-                });
+}
+function looksLikeExecutionEnvelope(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const candidate = value;
+    return typeof candidate.ok === 'boolean'
+        && Array.isArray(candidate.logs)
+        && candidate.meta !== undefined;
+}
+export async function execute(code) {
+    const startedAt = Date.now();
+    if (!code || !code.trim()) {
+        return buildFailureEnvelope(startedAt, 'EMPTY_CODE', 'Code cannot be empty');
+    }
+    const runnerPath = fileURLToPath(new URL('./executor-runner.js', import.meta.url));
+    const childArgs = [
+        ...getForwardedNodeFlags(),
+        '--max-old-space-size=256',
+        runnerPath
+    ];
+    return await new Promise((resolveEnvelope) => {
+        const child = spawn(process.execPath, childArgs, {
+            cwd: process.cwd(),
+            env: {
+                ...process.env,
+                STEWARD_EXECUTION_TIMEOUT_MS: String(EXECUTION_TIMEOUT_MS)
+            },
+            stdio: ['pipe', 'pipe', 'pipe']
+        });
+        let settled = false;
+        let stdout = '';
+        let stderr = '';
+        const finish = (envelope) => {
+            if (settled) {
+                return;
             }
-            const wrappedHandler = ensureTimerHandler(handler);
-            const timer = setTimeout(() => {
-                timers.delete(timer);
-                wrappedHandler();
-            }, timeout);
-            timers.add(timer);
-            return timer;
-        },
-        clearTimeout: (timer) => {
-            timers.delete(timer);
-            clearTimeout(timer);
-        },
-        setInterval: (handler, timeout) => {
-            if (timers.size >= MAX_TIMERS) {
-                throw new ExecutionError(`Timer limit exceeded (max ${MAX_TIMERS})`, {
-                    code: 'TIMER_LIMIT'
-                });
+            settled = true;
+            clearTimeout(killTimer);
+            resolveEnvelope(withDurationFallback(envelope, startedAt));
+        };
+        const captureOutput = (current, chunk) => {
+            if (current.length >= MAX_STDIO_CAPTURE) {
+                return current;
             }
-            const wrappedHandler = ensureTimerHandler(handler);
-            const timer = setInterval(wrappedHandler, timeout);
-            timers.add(timer);
-            return timer;
-        },
-        clearInterval: (timer) => {
-            timers.delete(timer);
-            clearInterval(timer);
-        },
-        Promise
-    };
-    const wrappedCode = `
-    (async () => {
-      ${code}
-    })()
-  `;
-    try {
-        const script = new vm.Script(wrappedCode, {
-            filename: 'codemode.js'
+            const remaining = MAX_STDIO_CAPTURE - current.length;
+            return current + chunk.toString('utf-8', 0, remaining);
+        };
+        const killTimer = setTimeout(() => {
+            child.kill('SIGKILL');
+            finish(buildFailureEnvelope(startedAt, 'TIMEOUT', `Execution timed out after ${EXECUTION_TIMEOUT_MS}ms`));
+        }, EXECUTION_TIMEOUT_MS);
+        child.stdout.on('data', (chunk) => {
+            stdout = captureOutput(stdout, chunk);
         });
-        const context = vm.createContext(sandbox);
-        const executionPromise = Promise.resolve(script.runInContext(context, {
-            timeout: EXECUTION_TIMEOUT_MS
-        }));
-        const timeoutPromise = new Promise((_resolve, reject) => {
-            executionTimeout = setTimeout(() => {
-                reject(new ExecutionError(`Execution timed out after ${EXECUTION_TIMEOUT_MS}ms`, {
-                    code: 'TIMEOUT'
-                }));
-            }, EXECUTION_TIMEOUT_MS);
+        child.stderr.on('data', (chunk) => {
+            stderr = captureOutput(stderr, chunk);
         });
-        const rawResult = await Promise.race([executionPromise, timeoutPromise]);
-        if (asyncCallbackError instanceof Error) {
-            throw new ExecutionError(asyncCallbackError.message, {
-                code: 'ASYNC_CALLBACK_ERROR',
-                stackTrace: asyncCallbackError.stack
-            });
-        }
-        const truncated = truncateResult(rawResult);
-        return buildEnvelope({
-            ok: true,
-            result: truncated.result,
-            error: null,
-            truncatedResult: truncated.truncatedResult,
-            resultWasUndefined: truncated.resultWasUndefined
+        child.on('error', (error) => {
+            const failure = normalizeFailure(error);
+            finish(buildFailureEnvelope(startedAt, failure.code, failure.message, failure.details));
         });
-    }
-    catch (error) {
-        const failure = normalizeFailure(error);
-        appendLog('error', [`${failure.code}: ${failure.message}`]);
-        return buildEnvelope({
-            ok: false,
-            result: null,
-            error: failure,
-            truncatedResult: false,
-            resultWasUndefined: false
+        child.on('close', (exitCode, signal) => {
+            if (settled) {
+                return;
+            }
+            const trimmedStdout = stdout.trim();
+            if (!trimmedStdout) {
+                const message = signal
+                    ? `Execution process terminated by signal ${signal}`
+                    : `Execution process exited with code ${exitCode ?? 0}`;
+                finish(buildFailureEnvelope(startedAt, 'EXECUTION_PROCESS_FAILURE', message, {
+                    exitCode,
+                    signal,
+                    stderr: stderr.trim() || undefined
+                }));
+                return;
+            }
+            try {
+                const parsed = JSON.parse(trimmedStdout);
+                if (looksLikeExecutionEnvelope(parsed)) {
+                    finish(parsed);
+                    return;
+                }
+                finish(buildFailureEnvelope(startedAt, 'INVALID_ENVELOPE', 'Execution process returned an invalid envelope', {
+                    outputPreview: trimmedStdout.slice(0, 2000),
+                    stderr: stderr.trim() || undefined,
+                    exitCode,
+                    signal
+                }));
+            }
+            catch (error) {
+                const failure = normalizeFailure(error);
+                finish(buildFailureEnvelope(startedAt, 'INVALID_JSON', failure.message, {
+                    outputPreview: trimmedStdout.slice(0, 2000),
+                    stderr: stderr.trim() || undefined,
+                    exitCode,
+                    signal
+                }));
+            }
         });
-    }
-    finally {
-        if (executionTimeout) {
-            clearTimeout(executionTimeout);
+        try {
+            child.stdin.end(JSON.stringify({ code }));
         }
-        timers.forEach((timer) => {
-            clearTimeout(timer);
-            clearInterval(timer);
-        });
-        timers.clear();
-    }
+        catch (error) {
+            const failure = normalizeFailure(error);
+            finish(buildFailureEnvelope(startedAt, 'EXECUTION_PIPE_FAILURE', failure.message));
+        }
+    });
 }

package/dist/host/src/index.js

@@ -4,7 +4,7 @@ function printUsage() {
     console.log(`prd - Steward CLI
 
 Usage:
-  prd ui [--preview] [--port <port>] [--host <host>]
+  prd ui [--preview] [--port <port>] [--host <host>] [--allow-remote]
   prd mcp
 
 Commands:
@@ -15,6 +15,7 @@ Options:
   --preview      Deprecated; ignored (kept for compatibility)
   --port <port>  Port for ui mode
   --host <host>  Host for ui mode
+  --allow-remote Allow non-loopback host binding
   -h, --help     Show this help message
 `);
 }
@@ -26,7 +27,7 @@ function parsePort(value) {
     return parsed;
 }
 function parseUiArgs(args) {
-    const options = { preview: false };
+    const options = { preview: false, allowRemote: false };
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         if (arg === '--preview') {
@@ -51,6 +52,10 @@ function parseUiArgs(args) {
             i += 1;
             continue;
         }
+        if (arg === '--allow-remote') {
+            options.allowRemote = true;
+            continue;
+        }
         throw new Error(`Unknown option for ui: ${arg}`);
     }
     return options;

package/dist/host/src/mcp.js

@@ -1,3 +1,6 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
@@ -50,11 +53,34 @@ function buildUnexpectedErrorEnvelope(error) {
         }
     };
 }
+function resolvePackageVersion() {
+    let currentDir = dirname(fileURLToPath(import.meta.url));
+    while (true) {
+        const packageJsonPath = join(currentDir, 'package.json');
+        if (existsSync(packageJsonPath)) {
+            try {
+                const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+                if (typeof packageJson.version === 'string' && packageJson.version.trim().length > 0) {
+                    return packageJson.version;
+                }
+            }
+            catch {
+                break;
+            }
+        }
+        const parentDir = dirname(currentDir);
+        if (parentDir === currentDir) {
+            break;
+        }
+        currentDir = parentDir;
+    }
+    return '0.0.0';
+}
 export async function runMcpServer() {
     await assertSqliteRuntimeSupport();
     const server = new McpServer({
         name: 'steward',
-        version: '0.1.0'
+        version: resolvePackageVersion()
     });
     registerStewardPrompts(server);
     server.tool('execute', getExecuteToolDescription(), {

package/dist/host/src/ui.js

@@ -2,6 +2,13 @@ import { existsSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+const DEFAULT_UI_HOST = '127.0.0.1';
+function isLoopbackHost(host) {
+    const normalizedHost = host.trim().toLowerCase();
+    return normalizedHost === '127.0.0.1'
+        || normalizedHost === 'localhost'
+        || normalizedHost === '::1';
+}
 function findPackageRoot(startDir) {
     let currentDir = startDir;
     while (true) {
@@ -26,15 +33,23 @@ export async function runUi(options) {
     }
     const args = [serverEntrypoint];
     const env = { ...process.env };
+    const hostFromEnv = env.NITRO_HOST || env.HOST;
+    const requestedHost = (options.host || hostFromEnv || DEFAULT_UI_HOST).trim();
+    const allowRemote = options.allowRemote || env.STEWARD_ALLOW_REMOTE === '1';
+    if (!isLoopbackHost(requestedHost) && !allowRemote) {
+        throw new Error(`Refusing to bind UI to non-loopback host "${requestedHost}" without explicit opt-in. `
+            + 'Use --allow-remote or set STEWARD_ALLOW_REMOTE=1.');
+    }
     env.NODE_ENV = env.NODE_ENV || 'production';
     if (options.port !== undefined) {
         const port = String(options.port);
         env.PORT = port;
         env.NITRO_PORT = port;
     }
-    if (options.host) {
-        env.HOST = options.host;
-        env.NITRO_HOST = options.host;
+    env.HOST = requestedHost;
+    env.NITRO_HOST = requestedHost;
+    if (allowRemote) {
+        env.STEWARD_ALLOW_REMOTE = '1';
     }
     const child = spawn(process.execPath, args, {
         cwd: packageRoot,

package/dist/server/utils/change-events.js

@@ -0,0 +1,33 @@
+const listeners = new Set();
+const pendingEvents = [];
+let debounceTimer = null;
+const DEBOUNCE_MS = 300;
+function flushPendingEvents() {
+    const dedupedEvents = new Map();
+    for (const event of pendingEvents) {
+        dedupedEvents.set(`${event.repoId}:${event.category}:${event.path}`, event);
+    }
+    pendingEvents.length = 0;
+    debounceTimer = null;
+    for (const event of dedupedEvents.values()) {
+        for (const listener of listeners) {
+            listener(event);
+        }
+    }
+}
+export function emitChange(event) {
+    pendingEvents.push(event);
+    if (debounceTimer) {
+        clearTimeout(debounceTimer);
+    }
+    debounceTimer = setTimeout(flushPendingEvents, DEBOUNCE_MS);
+}
+export function addChangeListener(listener) {
+    listeners.add(listener);
+    return () => {
+        listeners.delete(listener);
+    };
+}
+export function getChangeListenerCount() {
+    return listeners.size;
+}

package/dist/server/utils/git.js

@@ -208,15 +208,6 @@ export async function getCommitDiff(repoPath, sha) {
     if (!/^[0-9a-f]{4,40}$/i.test(sha)) {
         throw new Error(`Invalid commit SHA: ${sha}`);
     }
-    // Get file status and stats
-    const output = await execGit(repoPath, [
-        'show', sha,
-        '--format=',
-        '--name-status',
-        '--numstat',
-    ]);
-    // Parse the output - first part is numstat, then name-status
-    const lines = output.trim().split('\n').filter(l => l.trim());
     // We need to get both numstat and name-status info
     const numstatOutput = await execGit(repoPath, ['show', sha, '--format=', '--numstat']);
     const nameStatusOutput = await execGit(repoPath, ['show', sha, '--format=', '--name-status']);
@@ -344,12 +335,13 @@ function parseDiffHunks(diffOutput) {
             newLineNum = newStart;
             continue;
         }
-        // Skip diff headers
-        if (line.startsWith('diff --git') ||
-            line.startsWith('index ') ||
-            line.startsWith('---') ||
-            line.startsWith('+++') ||
-            line.startsWith('\\')) {
+        const isDiffHeader = line.startsWith('diff --git')
+            || line.startsWith('index ')
+            || /^--- (?:a\/.*|\/dev\/null)$/.test(line)
+            || /^\+\+\+ (?:b\/.*|\/dev\/null)$/.test(line)
+            || line === '\';
+        // Skip diff metadata lines
+        if (isDiffHeader) {
             continue;
         }
         // Parse diff lines
@@ -370,7 +362,7 @@ function parseDiffHunks(diffOutput) {
                 };
                 currentHunk.lines.push(diffLine);
             }
-            else if (line.startsWith(' ') || line === '') {
+            else if (line.startsWith(' ')) {
                 const diffLine = {
                     type: 'context',
                     content: line.substring(1),
@@ -386,6 +378,9 @@ function parseDiffHunks(diffOutput) {
     }
     return hunks;
 }
+export function parseDiffHunksForTest(diffOutput) {
+    return parseDiffHunks(diffOutput);
+}
 /**
  * Check if a file is binary by attempting to get its diff
  */