@thxgg/steward 0.1.16 → 0.1.17

package/.output/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thxgg/steward-prod",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "type": "module",
   "private": true,
   "dependencies": {
@@ -76,6 +76,7 @@
     "vue-demi": "0.14.10",
     "vue-router": "4.6.4",
     "vue-sonner": "1.3.2",
+    "zod": "3.25.76",
     "zwitch": "2.0.4"
   }
 }

package/README.md

@@ -55,6 +55,7 @@ Note: `execute` runs in a VM sandbox by design, so globals like `process` are in
 ```bash
 prd ui
 prd ui --port 3100 --host 127.0.0.1
+prd ui --host 0.0.0.0 --allow-remote
 prd mcp
 ```
 
@@ -143,8 +144,10 @@ Detailed API docs and examples: `docs/MCP.md`
 
 Steward reads local filesystem and git metadata by design.
 
-- Run only on trusted local machines
-- Do not expose directly to the public internet
+- By default, UI/API only accept loopback requests
+- Non-loopback access requires explicit opt-in (`--allow-remote` or `STEWARD_ALLOW_REMOTE=1`)
+- Optional token auth for remote API access: set `STEWARD_API_TOKEN`
+- For browser sessions, you can initialize the auth cookie with `?token=<STEWARD_API_TOKEN>`
 - Treat as a workstation tool, not a hosted multi-user service
 
 ## Storage
@@ -171,6 +174,8 @@ npm run build
 | `PRD_STATE_DB_PATH` | Absolute path to SQLite DB file |
 | `PRD_STATE_HOME` | Base directory for DB (`state.db` inside) |
 | `XDG_DATA_HOME` | Fallback base path for default DB location |
+| `STEWARD_ALLOW_REMOTE` | Set to `1` to allow non-loopback requests |
+| `STEWARD_API_TOKEN` | Optional token required for remote `/api/*` access |
 
 ## OpenCode Bundle
 

package/dist/host/src/api/prds.js

@@ -1,190 +1,24 @@
-import { promises as fs } from 'node:fs';
-import { basename, join } from 'node:path';
-import { resolveCommitRepo } from '../../../server/utils/git.js';
-import { discoverGitRepos, getRepos, saveRepos } from '../../../server/utils/repos.js';
-import { getPrdState, getPrdStateSummaries, migrateLegacyStateForRepo } from '../../../server/utils/prd-state.js';
+import { listPrdDocuments, readPrdDocument, readPrdProgress, readPrdTasks, resolveTaskCommits } from '../../../server/utils/prd-service.js';
 import { requireRepo } from './repo-context.js';
-function parseMetadata(content) {
-    const metadata = {};
-    const authorMatch = content.match(/\*{0,2}Author\*{0,2}:\*{0,2}\s*(.+?)(?:\n|$)/i);
-    if (authorMatch && authorMatch[1]) {
-        metadata.author = authorMatch[1].trim();
-    }
-    const dateMatch = content.match(/\*{0,2}Date\*{0,2}:\*{0,2}\s*(.+?)(?:\n|$)/i);
-    if (dateMatch && dateMatch[1]) {
-        metadata.date = dateMatch[1].trim();
-    }
-    const statusMatch = content.match(/\*{0,2}Status\*{0,2}:\*{0,2}\s*(.+?)(?:\n|$)/i);
-    if (statusMatch && statusMatch[1]) {
-        metadata.status = statusMatch[1].trim();
-    }
-    const shortcutLinkMatch = content.match(/\[([Ss][Cc]-\d+)\]\(([^)]+)\)/);
-    if (shortcutLinkMatch && shortcutLinkMatch[1] && shortcutLinkMatch[2]) {
-        metadata.shortcutStory = shortcutLinkMatch[1];
-        metadata.shortcutUrl = shortcutLinkMatch[2];
-    }
-    else {
-        const shortcutIdMatch = content.match(/\*{0,2}Shortcut(?:\s+Story)?\*{0,2}:\*{0,2}\s*([Ss][Cc]-\d+)/i);
-        if (shortcutIdMatch && shortcutIdMatch[1]) {
-            metadata.shortcutStory = shortcutIdMatch[1];
-        }
-    }
-    return metadata;
-}
-async function readPrdFile(repo, prdSlug) {
-    const prdPath = join(repo.path, 'docs', 'prd', `${prdSlug}.md`);
-    try {
-        return await fs.readFile(prdPath, 'utf-8');
-    }
-    catch {
-        throw new Error('PRD not found');
-    }
-}
 export const prds = {
     async list(repoId) {
         const repo = await requireRepo(repoId);
-        await migrateLegacyStateForRepo(repo);
-        const prdDir = join(repo.path, 'docs', 'prd');
-        let prdFiles = [];
-        try {
-            const files = await fs.readdir(prdDir);
-            prdFiles = files.filter((file) => file.endsWith('.md'));
-        }
-        catch {
-            return [];
-        }
-        const stateSummaries = await getPrdStateSummaries(repo.id);
-        const items = await Promise.all(prdFiles.map(async (filename) => {
-            const slug = basename(filename, '.md');
-            const filePath = join(prdDir, filename);
-            let name = slug;
-            let modifiedAt = 0;
-            try {
-                const [content, stat] = await Promise.all([
-                    fs.readFile(filePath, 'utf-8'),
-                    fs.stat(filePath)
-                ]);
-                modifiedAt = stat.mtime.getTime();
-                const h1Match = content.match(/^#\s+(.+)$/m);
-                if (h1Match && h1Match[1]) {
-                    name = h1Match[1].trim();
-                }
-            }
-            catch {
-                // Keep default values when a file cannot be read.
-            }
-            const stateSummary = stateSummaries.get(slug);
-            return {
-                slug,
-                name,
-                source: `docs/prd/${filename}`,
-                hasState: !!stateSummary?.hasState,
-                modifiedAt,
-                ...(stateSummary?.taskCount !== undefined && { taskCount: stateSummary.taskCount }),
-                ...(stateSummary?.completedCount !== undefined && { completedCount: stateSummary.completedCount })
-            };
-        }));
-        items.sort((a, b) => b.modifiedAt - a.modifiedAt);
-        return items;
+        return await listPrdDocuments(repo);
     },
     async getDocument(repoId, prdSlug) {
         const repo = await requireRepo(repoId);
-        const content = await readPrdFile(repo, prdSlug);
-        let name = prdSlug;
-        const h1Match = content.match(/^#\s+(.+)$/m);
-        if (h1Match && h1Match[1]) {
-            name = h1Match[1].trim();
-        }
-        return {
-            slug: prdSlug,
-            name,
-            content,
-            metadata: parseMetadata(content)
-        };
+        return await readPrdDocument(repo, prdSlug);
     },
     async getTasks(repoId, prdSlug) {
         const repo = await requireRepo(repoId);
-        await migrateLegacyStateForRepo(repo);
-        const state = await getPrdState(repo.id, prdSlug);
-        return state?.tasks ?? null;
+        return await readPrdTasks(repo, prdSlug);
     },
     async getProgress(repoId, prdSlug) {
         const repo = await requireRepo(repoId);
-        await migrateLegacyStateForRepo(repo);
-        const state = await getPrdState(repo.id, prdSlug);
-        return state?.progress ?? null;
+        return await readPrdProgress(repo, prdSlug);
     },
     async getTaskCommits(repoId, prdSlug, taskId) {
         const repo = await requireRepo(repoId);
-        await migrateLegacyStateForRepo(repo);
-        const state = await getPrdState(repo.id, prdSlug);
-        const progress = state?.progress ?? null;
-        if (!progress) {
-            return [];
-        }
-        const taskLogs = Array.isArray(progress.taskLogs) ? progress.taskLogs : [];
-        const taskLog = taskLogs.find((log) => log.taskId === taskId);
-        if (!taskLog) {
-            return [];
-        }
-        if (!taskLog.commits || taskLog.commits.length === 0) {
-            return [];
-        }
-        const resolvedCommits = [];
-        const failedEntries = [];
-        for (const commitEntry of taskLog.commits) {
-            try {
-                const resolved = await resolveCommitRepo(repo, commitEntry);
-                resolvedCommits.push({
-                    sha: resolved.sha,
-                    repo: resolved.repoPath
-                });
-            }
-            catch {
-                failedEntries.push(commitEntry);
-            }
-        }
-        if (failedEntries.length > 0) {
-            const newGitRepos = await discoverGitRepos(repo.path);
-            const existingPaths = new Set((repo.gitRepos || []).map((gitRepo) => gitRepo.relativePath));
-            const hasNewRepos = newGitRepos.some((gitRepo) => !existingPaths.has(gitRepo.relativePath));
-            let resolvedWithUpdatedRepo = false;
-            if (hasNewRepos) {
-                const allRepos = await getRepos();
-                const repoIndex = allRepos.findIndex((candidate) => candidate.id === repoId);
-                if (repoIndex !== -1) {
-                    const updatedRepo = {
-                        ...allRepos[repoIndex],
-                        gitRepos: newGitRepos.length > 0 ? newGitRepos : undefined
-                    };
-                    allRepos[repoIndex] = updatedRepo;
-                    await saveRepos(allRepos);
-                    resolvedWithUpdatedRepo = true;
-                    for (const commitEntry of failedEntries) {
-                        try {
-                            const resolved = await resolveCommitRepo(updatedRepo, commitEntry);
-                            resolvedCommits.push({
-                                sha: resolved.sha,
-                                repo: resolved.repoPath
-                            });
-                        }
-                        catch {
-                            const sha = typeof commitEntry === 'string' ? commitEntry : commitEntry.sha;
-                            resolvedCommits.push({ sha, repo: '' });
-                        }
-                    }
-                }
-            }
-            if (!resolvedWithUpdatedRepo) {
-                for (const commitEntry of failedEntries) {
-                    const sha = typeof commitEntry === 'string' ? commitEntry : commitEntry.sha;
-                    resolvedCommits.push({
-                        sha,
-                        repo: ''
-                    });
-                }
-            }
-        }
-        return resolvedCommits;
+        return await resolveTaskCommits(repo, prdSlug, taskId);
     }
 };

package/dist/host/src/api/repos.js

@@ -1,4 +1,4 @@
-import { addRepo, discoverGitRepos, getRepoById, getRepos, removeRepo, saveRepos, validateRepoPath } from '../../../server/utils/repos.js';
+import { addRepo, discoverGitRepos, getRepoById, getRepos, removeRepo, updateRepoGitRepos, validateRepoPath } from '../../../server/utils/repos.js';
 import { migrateLegacyStateForRepo } from '../../../server/utils/prd-state.js';
 import { requireCurrentRepo, requireRepo } from './repo-context.js';
 export const repos = {
@@ -29,22 +29,9 @@ export const repos = {
         return { removed: true };
     },
     async refreshGitRepos(repoId) {
-        await requireRepo(repoId);
-        const allRepos = await getRepos();
-        const repoIndex = allRepos.findIndex((repo) => repo.id === repoId);
-        if (repoIndex === -1) {
-            throw new Error('Repository not found');
-        }
-        const repo = allRepos[repoIndex];
+        const repo = await requireRepo(repoId);
         const gitRepos = await discoverGitRepos(repo.path);
-        if (gitRepos.length > 0) {
-            repo.gitRepos = gitRepos;
-        }
-        else {
-            delete repo.gitRepos;
-        }
-        allRepos[repoIndex] = repo;
-        await saveRepos(allRepos);
+        await updateRepoGitRepos(repo.id, gitRepos.length > 0 ? gitRepos : undefined);
         return {
             discovered: gitRepos.length,
             gitRepos

package/dist/host/src/api/state.js

@@ -1,9 +1,14 @@
 import { getPrdState, getPrdStateSummaries, migrateLegacyStateForRepo, upsertPrdState } from '../../../server/utils/prd-state.js';
+import { parseProgressFile, parseTasksFile } from '../../../server/utils/state-schema.js';
 import { requireCurrentRepo, requireRepo, requireRepoByPath } from './repo-context.js';
 function mapStateUpdate(payload) {
     return {
-        ...(payload.tasks !== undefined && { tasks: payload.tasks }),
-        ...(payload.progress !== undefined && { progress: payload.progress }),
+        ...(payload.tasks !== undefined && {
+            tasks: payload.tasks === null ? null : parseTasksFile(payload.tasks)
+        }),
+        ...(payload.progress !== undefined && {
+            progress: payload.progress === null ? null : parseProgressFile(payload.progress)
+        }),
         ...(payload.notes !== undefined && { notes: payload.notes })
     };
 }

package/dist/host/src/executor-runner.js

@@ -0,0 +1,368 @@
+import vm from 'node:vm';
+import { git, prds, repos, state } from './api/index.js';
+import { getStewardHelp } from './help.js';
+const MAX_OUTPUT_SIZE = 50_000;
+const EXECUTION_TIMEOUT_MS = Number.parseInt(process.env.STEWARD_EXECUTION_TIMEOUT_MS || '30000', 10);
+const MAX_TIMERS = 100;
+const MAX_LOG_ENTRIES = 200;
+const MAX_LOG_OUTPUT_SIZE = 20_000;
+const MAX_LOG_ENTRY_SIZE = 2_000;
+class ExecutionError extends Error {
+    options;
+    constructor(message, options) {
+        super(message);
+        this.options = options;
+        this.name = 'ExecutionError';
+    }
+}
+function deepFreeze(value) {
+    if (!value || (typeof value !== 'object' && typeof value !== 'function') || Object.isFrozen(value)) {
+        return value;
+    }
+    for (const key of Reflect.ownKeys(value)) {
+        const property = value[key];
+        if (property && (typeof property === 'object' || typeof property === 'function')) {
+            deepFreeze(property);
+        }
+    }
+    return Object.freeze(value);
+}
+function safeJsonStringify(value) {
+    const seen = new WeakSet();
+    try {
+        return JSON.stringify(value, (_key, currentValue) => {
+            if (typeof currentValue === 'bigint') {
+                return `${currentValue}n`;
+            }
+            if (typeof currentValue === 'function') {
+                const functionName = currentValue.name ? ` ${currentValue.name}` : '';
+                return `[Function${functionName}]`;
+            }
+            if (typeof currentValue === 'symbol') {
+                return currentValue.toString();
+            }
+            if (typeof currentValue === 'object' && currentValue !== null) {
+                if (seen.has(currentValue)) {
+                    return '[Circular]';
+                }
+                seen.add(currentValue);
+            }
+            return currentValue;
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+function formatLogValue(value) {
+    if (typeof value === 'string') {
+        return value;
+    }
+    const json = safeJsonStringify(value);
+    if (json !== undefined) {
+        return json;
+    }
+    return String(value);
+}
+function truncateResult(result) {
+    if (result === undefined) {
+        return {
+            result: null,
+            truncatedResult: false,
+            resultWasUndefined: true
+        };
+    }
+    const json = safeJsonStringify(result);
+    if (json === undefined) {
+        return {
+            result: {
+                _unserializable: true,
+                preview: String(result)
+            },
+            truncatedResult: false,
+            resultWasUndefined: false
+        };
+    }
+    if (json.length <= MAX_OUTPUT_SIZE) {
+        return {
+            result,
+            truncatedResult: false,
+            resultWasUndefined: false
+        };
+    }
+    return {
+        result: {
+            _truncated: true,
+            size: json.length,
+            preview: json.slice(0, MAX_OUTPUT_SIZE),
+            message: `Output truncated (${json.length} chars, showing first ${MAX_OUTPUT_SIZE})`
+        },
+        truncatedResult: true,
+        resultWasUndefined: false
+    };
+}
+function normalizeFailure(error) {
+    if (error instanceof ExecutionError) {
+        return {
+            code: error.options?.code || 'EXECUTION_ERROR',
+            message: error.message,
+            ...(error.options?.stackTrace && { stack: error.options.stackTrace }),
+            ...(error.options?.details !== undefined && { details: error.options.details })
+        };
+    }
+    if (error instanceof Error) {
+        const { code, details } = error;
+        return {
+            code: typeof code === 'string' ? code : 'EXECUTION_ERROR',
+            message: error.message,
+            ...(error.stack && { stack: error.stack }),
+            ...(details !== undefined && { details })
+        };
+    }
+    return {
+        code: 'EXECUTION_ERROR',
+        message: String(error)
+    };
+}
+async function execute(code) {
+    const startedAt = Date.now();
+    const logs = [];
+    let totalLogChars = 0;
+    let logsTruncated = false;
+    const appendLog = (level, args) => {
+        if (logs.length >= MAX_LOG_ENTRIES) {
+            logsTruncated = true;
+            return;
+        }
+        let message = args.map(formatLogValue).join(' ');
+        if (message.length > MAX_LOG_ENTRY_SIZE) {
+            message = `${message.slice(0, MAX_LOG_ENTRY_SIZE)}...`;
+            logsTruncated = true;
+        }
+        if (totalLogChars + message.length > MAX_LOG_OUTPUT_SIZE) {
+            logsTruncated = true;
+            return;
+        }
+        totalLogChars += message.length;
+        logs.push({
+            level,
+            message,
+            timestamp: new Date().toISOString()
+        });
+    };
+    const buildEnvelope = (params) => ({
+        ok: params.ok,
+        result: params.result,
+        logs,
+        error: params.error,
+        meta: {
+            timeoutMs: EXECUTION_TIMEOUT_MS,
+            durationMs: Date.now() - startedAt,
+            truncatedResult: params.truncatedResult,
+            truncatedLogs: logsTruncated,
+            resultWasUndefined: params.resultWasUndefined
+        }
+    });
+    if (!code || !code.trim()) {
+        const error = normalizeFailure(new ExecutionError('Code cannot be empty', { code: 'EMPTY_CODE' }));
+        return buildEnvelope({
+            ok: false,
+            result: null,
+            error,
+            truncatedResult: false,
+            resultWasUndefined: false
+        });
+    }
+    const timers = new Set();
+    let executionTimeout = null;
+    let asyncCallbackError = null;
+    const wrapTimerHandler = (handler) => {
+        return () => {
+            try {
+                handler();
+            }
+            catch (error) {
+                const normalizedError = error instanceof Error
+                    ? error
+                    : new Error(String(error));
+                asyncCallbackError = normalizedError;
+                appendLog('error', ['Timer callback error:', normalizedError.message]);
+            }
+        };
+    };
+    const ensureTimerHandler = (handler) => {
+        if (typeof handler !== 'function') {
+            throw new ExecutionError('Timer handler must be a function', {
+                code: 'INVALID_TIMER_HANDLER'
+            });
+        }
+        return wrapTimerHandler(handler);
+    };
+    const apiSurface = deepFreeze({
+        repos,
+        prds,
+        git,
+        state,
+        steward: {
+            help: () => getStewardHelp()
+        }
+    });
+    const sandbox = {
+        ...apiSurface,
+        console: deepFreeze({
+            log: (...args) => appendLog('log', args),
+            info: (...args) => appendLog('info', args),
+            warn: (...args) => appendLog('warn', args),
+            error: (...args) => appendLog('error', args)
+        }),
+        setTimeout: (handler, timeout) => {
+            if (timers.size >= MAX_TIMERS) {
+                throw new ExecutionError(`Timer limit exceeded (max ${MAX_TIMERS})`, {
+                    code: 'TIMER_LIMIT'
+                });
+            }
+            const wrappedHandler = ensureTimerHandler(handler);
+            const timer = setTimeout(() => {
+                timers.delete(timer);
+                wrappedHandler();
+            }, timeout);
+            timers.add(timer);
+            return timer;
+        },
+        clearTimeout: (timer) => {
+            timers.delete(timer);
+            clearTimeout(timer);
+        },
+        setInterval: (handler, timeout) => {
+            if (timers.size >= MAX_TIMERS) {
+                throw new ExecutionError(`Timer limit exceeded (max ${MAX_TIMERS})`, {
+                    code: 'TIMER_LIMIT'
+                });
+            }
+            const wrappedHandler = ensureTimerHandler(handler);
+            const timer = setInterval(wrappedHandler, timeout);
+            timers.add(timer);
+            return timer;
+        },
+        clearInterval: (timer) => {
+            timers.delete(timer);
+            clearInterval(timer);
+        },
+        Promise
+    };
+    const wrappedCode = `
+    (async () => {
+      ${code}
+    })()
+  `;
+    try {
+        const script = new vm.Script(wrappedCode, {
+            filename: 'codemode.js'
+        });
+        const context = vm.createContext(sandbox);
+        const executionPromise = Promise.resolve(script.runInContext(context, {
+            timeout: EXECUTION_TIMEOUT_MS
+        }));
+        const timeoutPromise = new Promise((_resolve, reject) => {
+            executionTimeout = setTimeout(() => {
+                reject(new ExecutionError(`Execution timed out after ${EXECUTION_TIMEOUT_MS}ms`, {
+                    code: 'TIMEOUT'
+                }));
+            }, EXECUTION_TIMEOUT_MS);
+        });
+        const rawResult = await Promise.race([executionPromise, timeoutPromise]);
+        if (asyncCallbackError instanceof Error) {
+            throw new ExecutionError(asyncCallbackError.message, {
+                code: 'ASYNC_CALLBACK_ERROR',
+                stackTrace: asyncCallbackError.stack
+            });
+        }
+        const truncated = truncateResult(rawResult);
+        return buildEnvelope({
+            ok: true,
+            result: truncated.result,
+            error: null,
+            truncatedResult: truncated.truncatedResult,
+            resultWasUndefined: truncated.resultWasUndefined
+        });
+    }
+    catch (error) {
+        const failure = normalizeFailure(error);
+        appendLog('error', [`${failure.code}: ${failure.message}`]);
+        return buildEnvelope({
+            ok: false,
+            result: null,
+            error: failure,
+            truncatedResult: false,
+            resultWasUndefined: false
+        });
+    }
+    finally {
+        if (executionTimeout) {
+            clearTimeout(executionTimeout);
+        }
+        timers.forEach((timer) => {
+            clearTimeout(timer);
+            clearInterval(timer);
+        });
+        timers.clear();
+    }
+}
+async function readStdin() {
+    return await new Promise((resolveInput) => {
+        let input = '';
+        process.stdin.setEncoding('utf-8');
+        process.stdin.on('data', (chunk) => {
+            input += chunk;
+        });
+        process.stdin.on('end', () => {
+            resolveInput(input);
+        });
+    });
+}
+function printEnvelope(envelope) {
+    process.stdout.write(JSON.stringify(envelope));
+}
+function buildBootstrapFailure(code, message) {
+    return {
+        ok: false,
+        result: null,
+        logs: [],
+        error: {
+            code,
+            message
+        },
+        meta: {
+            timeoutMs: EXECUTION_TIMEOUT_MS,
+            durationMs: 0,
+            truncatedResult: false,
+            truncatedLogs: false,
+            resultWasUndefined: false
+        }
+    };
+}
+async function main() {
+    const rawInput = await readStdin();
+    if (!rawInput.trim()) {
+        printEnvelope(buildBootstrapFailure('EMPTY_PAYLOAD', 'Execution payload is empty'));
+        return;
+    }
+    let payload;
+    try {
+        payload = JSON.parse(rawInput);
+    }
+    catch (error) {
+        printEnvelope(buildBootstrapFailure('INVALID_PAYLOAD', `Failed to parse execution payload: ${String(error)}`));
+        return;
+    }
+    if (typeof payload.code !== 'string') {
+        printEnvelope(buildBootstrapFailure('INVALID_PAYLOAD', 'Execution payload must include a string "code" field'));
+        return;
+    }
+    const envelope = await execute(payload.code);
+    printEnvelope(envelope);
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    printEnvelope(buildBootstrapFailure('RUNNER_FAILURE', message));
+});