@thxgg/steward 0.1.17 → 0.1.18

package/.output/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thxgg/steward-prod",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "type": "module",
   "private": true,
   "dependencies": {

package/README.md

@@ -55,7 +55,6 @@ Note: `execute` runs in a VM sandbox by design, so globals like `process` are in
 ```bash
 prd ui
 prd ui --port 3100 --host 127.0.0.1
-prd ui --host 0.0.0.0 --allow-remote
 prd mcp
 ```
 
@@ -144,10 +143,8 @@ Detailed API docs and examples: `docs/MCP.md`
 
 Steward reads local filesystem and git metadata by design.
 
-- By default, UI/API only accept loopback requests
-- Non-loopback access requires explicit opt-in (`--allow-remote` or `STEWARD_ALLOW_REMOTE=1`)
-- Optional token auth for remote API access: set `STEWARD_API_TOKEN`
-- For browser sessions, you can initialize the auth cookie with `?token=<STEWARD_API_TOKEN>`
+- UI/API accept loopback requests only
+- Non-loopback requests are rejected
 - Treat as a workstation tool, not a hosted multi-user service
 
 ## Storage
@@ -174,8 +171,6 @@ npm run build
 | `PRD_STATE_DB_PATH` | Absolute path to SQLite DB file |
 | `PRD_STATE_HOME` | Base directory for DB (`state.db` inside) |
 | `XDG_DATA_HOME` | Fallback base path for default DB location |
-| `STEWARD_ALLOW_REMOTE` | Set to `1` to allow non-loopback requests |
-| `STEWARD_API_TOKEN` | Optional token required for remote `/api/*` access |
 
 ## OpenCode Bundle
 

package/dist/host/src/api/repos.js

@@ -1,5 +1,4 @@
 import { addRepo, discoverGitRepos, getRepoById, getRepos, removeRepo, updateRepoGitRepos, validateRepoPath } from '../../../server/utils/repos.js';
-import { migrateLegacyStateForRepo } from '../../../server/utils/prd-state.js';
 import { requireCurrentRepo, requireRepo } from './repo-context.js';
 export const repos = {
     async list() {
@@ -17,7 +16,6 @@ export const repos = {
             throw new Error(validation.error || 'Invalid repository path');
         }
         const repo = await addRepo(path, name);
-        await migrateLegacyStateForRepo(repo);
         return repo;
     },
     async remove(repoId) {

package/dist/host/src/api/state.js

@@ -1,4 +1,4 @@
-import { getPrdState, getPrdStateSummaries, migrateLegacyStateForRepo, upsertPrdState } from '../../../server/utils/prd-state.js';
+import { getPrdState, getPrdStateSummaries, upsertPrdState } from '../../../server/utils/prd-state.js';
 import { parseProgressFile, parseTasksFile } from '../../../server/utils/state-schema.js';
 import { requireCurrentRepo, requireRepo, requireRepoByPath } from './repo-context.js';
 function mapStateUpdate(payload) {
@@ -18,34 +18,28 @@ function mapSummaryMap(summaries) {
 export const state = {
     async get(repoId, slug) {
         const repo = await requireRepo(repoId);
-        await migrateLegacyStateForRepo(repo);
         return await getPrdState(repo.id, slug);
     },
     async getByPath(repoPath, slug) {
         const repo = await requireRepoByPath(repoPath);
-        await migrateLegacyStateForRepo(repo);
         return await getPrdState(repo.id, slug);
     },
     async getCurrent(slug) {
         const repo = await requireCurrentRepo();
-        await migrateLegacyStateForRepo(repo);
         return await getPrdState(repo.id, slug);
     },
     async summaries(repoId) {
         const repo = await requireRepo(repoId);
-        await migrateLegacyStateForRepo(repo);
         const summaries = await getPrdStateSummaries(repo.id);
         return mapSummaryMap(summaries);
     },
     async summariesByPath(repoPath) {
         const repo = await requireRepoByPath(repoPath);
-        await migrateLegacyStateForRepo(repo);
         const summaries = await getPrdStateSummaries(repo.id);
         return mapSummaryMap(summaries);
     },
     async summariesCurrent() {
         const repo = await requireCurrentRepo();
-        await migrateLegacyStateForRepo(repo);
         const summaries = await getPrdStateSummaries(repo.id);
         return mapSummaryMap(summaries);
     },

package/dist/host/src/index.js

@@ -4,7 +4,7 @@ function printUsage() {
     console.log(`prd - Steward CLI
 
 Usage:
-  prd ui [--preview] [--port <port>] [--host <host>] [--allow-remote]
+  prd ui [--preview] [--port <port>] [--host <host>]
   prd mcp
 
 Commands:
@@ -15,7 +15,6 @@ Options:
   --preview      Deprecated; ignored (kept for compatibility)
   --port <port>  Port for ui mode
   --host <host>  Host for ui mode
-  --allow-remote Allow non-loopback host binding
   -h, --help     Show this help message
 `);
 }
@@ -27,7 +26,7 @@ function parsePort(value) {
     return parsed;
 }
 function parseUiArgs(args) {
-    const options = { preview: false, allowRemote: false };
+    const options = { preview: false };
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         if (arg === '--preview') {
@@ -52,10 +51,6 @@ function parseUiArgs(args) {
             i += 1;
             continue;
         }
-        if (arg === '--allow-remote') {
-            options.allowRemote = true;
-            continue;
-        }
         throw new Error(`Unknown option for ui: ${arg}`);
     }
     return options;

package/dist/host/src/ui.js

@@ -35,10 +35,8 @@ export async function runUi(options) {
     const env = { ...process.env };
     const hostFromEnv = env.NITRO_HOST || env.HOST;
     const requestedHost = (options.host || hostFromEnv || DEFAULT_UI_HOST).trim();
-    const allowRemote = options.allowRemote || env.STEWARD_ALLOW_REMOTE === '1';
-    if (!isLoopbackHost(requestedHost) && !allowRemote) {
-        throw new Error(`Refusing to bind UI to non-loopback host "${requestedHost}" without explicit opt-in. `
-            + 'Use --allow-remote or set STEWARD_ALLOW_REMOTE=1.');
+    if (!isLoopbackHost(requestedHost)) {
+        throw new Error(`Refusing to bind UI to non-loopback host "${requestedHost}". Steward only supports loopback hosts.`);
     }
     env.NODE_ENV = env.NODE_ENV || 'production';
     if (options.port !== undefined) {
@@ -48,9 +46,6 @@ export async function runUi(options) {
     }
     env.HOST = requestedHost;
     env.NITRO_HOST = requestedHost;
-    if (allowRemote) {
-        env.STEWARD_ALLOW_REMOTE = '1';
-    }
     const child = spawn(process.execPath, args, {
         cwd: packageRoot,
         stdio: 'inherit',

package/dist/server/utils/prd-service.js

@@ -1,7 +1,7 @@
 import { promises as fs } from 'node:fs';
 import { basename, isAbsolute, join, relative, resolve } from 'node:path';
 import { resolveCommitRepo } from './git.js';
-import { getPrdState, getPrdStateSummaries, migrateLegacyStateForRepo } from './prd-state.js';
+import { getPrdState, getPrdStateSummaries } from './prd-state.js';
 import { discoverGitRepos, updateRepoGitRepos } from './repos.js';
 const PRD_SLUG_PATTERN = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
 function normalizePathSlashes(path) {
@@ -91,7 +91,6 @@ export async function readPrdDocument(repo, prdSlug) {
     };
 }
 export async function listPrdDocuments(repo) {
-    await migrateLegacyStateForRepo(repo);
     const prdDir = join(repo.path, 'docs', 'prd');
     let prdFiles = [];
     try {
@@ -140,13 +139,11 @@ export async function listPrdDocuments(repo) {
 }
 export async function readPrdTasks(repo, prdSlug) {
     assertValidPrdSlug(prdSlug);
-    await migrateLegacyStateForRepo(repo);
     const state = await getPrdState(repo.id, prdSlug);
     return state?.tasks ?? null;
 }
 export async function readPrdProgress(repo, prdSlug) {
     assertValidPrdSlug(prdSlug);
-    await migrateLegacyStateForRepo(repo);
     const state = await getPrdState(repo.id, prdSlug);
     return state?.progress ?? null;
 }
@@ -180,7 +177,6 @@ async function refreshDiscoveredGitRepos(repo) {
 }
 export async function resolveTaskCommits(repo, prdSlug, taskId) {
     assertValidPrdSlug(prdSlug);
-    await migrateLegacyStateForRepo(repo);
     const state = await getPrdState(repo.id, prdSlug);
     const progress = state?.progress ?? null;
     if (!progress) {

package/dist/server/utils/prd-state.js

@@ -1,11 +1,6 @@
-import { promises as fs } from 'node:fs';
-import { join } from 'node:path';
 import { emitChange } from './change-events.js';
 import { dbAll, dbGet, dbRun } from './db.js';
 import { parseProgressFile, parseTasksFile } from './state-schema.js';
-const LEGACY_STATE_STABLE_MS = 0;
-const migrationInFlight = new Map();
-const cleanupCompletedRepoIds = new Set();
 function parseStoredJson(raw, fieldName, parseValue) {
     if (!raw) {
         return null;
@@ -124,118 +119,3 @@ export async function upsertPrdState(repoId, slug, update) {
         });
     }
 }
-async function readStableLegacyFile(filePath, minFileAgeMs) {
-    try {
-        const stats = await fs.stat(filePath);
-        if (!stats.isFile()) {
-            return null;
-        }
-        if (Date.now() - stats.mtimeMs < minFileAgeMs) {
-            return null;
-        }
-        return await fs.readFile(filePath, 'utf-8');
-    }
-    catch {
-        return null;
-    }
-}
-async function readLegacyJsonFile(filePath, label, minFileAgeMs) {
-    const content = await readStableLegacyFile(filePath, minFileAgeMs);
-    if (!content) {
-        return { value: null, imported: false };
-    }
-    try {
-        return { value: JSON.parse(content), imported: true };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.warn(`[legacy-state] Skipping invalid ${label} at ${filePath}: ${message}`);
-        return { value: null, imported: false };
-    }
-}
-async function removeIfExists(filePath) {
-    try {
-        await fs.unlink(filePath);
-    }
-    catch {
-        // File may already be removed.
-    }
-}
-async function removeDirIfEmpty(dirPath) {
-    try {
-        const entries = await fs.readdir(dirPath);
-        if (entries.length === 0) {
-            await fs.rmdir(dirPath);
-        }
-    }
-    catch {
-        // Directory may not exist or may contain files.
-    }
-}
-async function runLegacyStateMigration(repo, cleanupLegacyFiles, minFileAgeMs) {
-    const legacyStateDir = join(repo.path, '.claude', 'state');
-    const entries = await fs.readdir(legacyStateDir, { withFileTypes: true, encoding: 'utf8' }).catch(() => null);
-    if (!entries) {
-        return;
-    }
-    for (const entry of entries) {
-        if (!entry.isDirectory()) {
-            continue;
-        }
-        const slug = entry.name;
-        const slugDir = join(legacyStateDir, slug);
-        const tasksPath = join(slugDir, 'tasks.json');
-        const progressPath = join(slugDir, 'progress.json');
-        const notesPath = join(slugDir, 'notes.md');
-        const [tasksResult, progressResult, notesContent] = await Promise.all([
-            readLegacyJsonFile(tasksPath, 'tasks.json', minFileAgeMs),
-            readLegacyJsonFile(progressPath, 'progress.json', minFileAgeMs),
-            readStableLegacyFile(notesPath, minFileAgeMs)
-        ]);
-        const shouldImportNotes = notesContent !== null;
-        const shouldImport = tasksResult.imported || progressResult.imported || shouldImportNotes;
-        if (!shouldImport) {
-            continue;
-        }
-        await upsertPrdState(repo.id, slug, {
-            ...(tasksResult.imported && { tasks: tasksResult.value }),
-            ...(progressResult.imported && { progress: progressResult.value }),
-            ...(shouldImportNotes && { notes: notesContent })
-        });
-        if (cleanupLegacyFiles) {
-            if (tasksResult.imported) {
-                await removeIfExists(tasksPath);
-            }
-            if (progressResult.imported) {
-                await removeIfExists(progressPath);
-            }
-            if (shouldImportNotes) {
-                await removeIfExists(notesPath);
-            }
-            await removeDirIfEmpty(slugDir);
-        }
-    }
-    if (cleanupLegacyFiles) {
-        await removeDirIfEmpty(legacyStateDir);
-    }
-}
-export async function migrateLegacyStateForRepo(repo, options = {}) {
-    const cleanupLegacyFiles = options.cleanupLegacyFiles
-        ?? !cleanupCompletedRepoIds.has(repo.id);
-    const minFileAgeMs = options.minFileAgeMs ?? LEGACY_STATE_STABLE_MS;
-    const inFlight = migrationInFlight.get(repo.id);
-    if (inFlight) {
-        return inFlight;
-    }
-    const migrationPromise = runLegacyStateMigration(repo, cleanupLegacyFiles, minFileAgeMs)
-        .then(() => {
-        if (cleanupLegacyFiles) {
-            cleanupCompletedRepoIds.add(repo.id);
-        }
-    })
-        .finally(() => {
-        migrationInFlight.delete(repo.id);
-    });
-    migrationInFlight.set(repo.id, migrationPromise);
-    return migrationPromise;
-}

package/dist/server/utils/repos.js

@@ -274,12 +274,22 @@ export async function discoverGitRepos(basePath, maxDepth = 4) {
     return discovered;
 }
 export async function validateRepoPath(path) {
-    // Normalize the path
-    const resolvedPath = resolve(path);
-    // Ensure path is absolute (starts with / on Unix or drive letter on Windows)
-    if (!resolvedPath.startsWith('/') && !/^[A-Za-z]:/.test(resolvedPath)) {
+    const trimmedPath = path.trim();
+    if (trimmedPath.length === 0) {
+        return { valid: false, error: 'Path is required' };
+    }
+    if (trimmedPath.length > 4096) {
+        return { valid: false, error: 'Path is too long' };
+    }
+    if (trimmedPath.includes('\u0000')) {
+        return { valid: false, error: 'Path contains invalid characters' };
+    }
+    const isWindowsAbsolutePath = /^[A-Za-z]:[\\/]/.test(trimmedPath);
+    if (!isAbsolute(trimmedPath) && !isWindowsAbsolutePath) {
         return { valid: false, error: 'Path must be absolute' };
     }
+    // Normalize the path
+    const resolvedPath = resolve(trimmedPath);
     try {
         const stats = await fs.stat(resolvedPath);
         if (!stats.isDirectory()) {

package/dist/server/utils/task-graph.js

@@ -1,5 +1,5 @@
 import { promises as fs } from 'node:fs';
-import { getPrdState, getPrdStateSummaries, migrateLegacyStateForRepo } from './prd-state.js';
+import { getPrdState, getPrdStateSummaries } from './prd-state.js';
 import { resolvePrdMarkdownPath } from './prd-service.js';
 const NODE_SEPARATOR = '::';
 const MISSING_PREFIX = 'missing';
@@ -139,7 +139,6 @@ function buildGraphFromInputs(inputs) {
     };
 }
 export async function buildPrdGraph(repo, prdSlug) {
-    await migrateLegacyStateForRepo(repo);
     const [state, prdName] = await Promise.all([
         getPrdState(repo.id, prdSlug),
         resolvePrdName(repo, prdSlug)
@@ -162,22 +161,23 @@ export async function buildPrdGraph(repo, prdSlug) {
     };
 }
 export async function buildRepoGraph(repo) {
-    await migrateLegacyStateForRepo(repo);
     const summaries = await getPrdStateSummaries(repo.id);
     const slugs = [...summaries.keys()].sort((a, b) => a.localeCompare(b));
-    const inputs = [];
-    for (const slug of slugs) {
-        const state = await getPrdState(repo.id, slug);
+    const inputs = (await Promise.all(slugs.map(async (slug) => {
+        const [state, prdName] = await Promise.all([
+            getPrdState(repo.id, slug),
+            resolvePrdName(repo, slug)
+        ]);
         const tasks = state?.tasks?.tasks;
         if (!Array.isArray(tasks)) {
-            continue;
+            return null;
         }
-        inputs.push({
+        return {
             prdSlug: slug,
-            prdName: await resolvePrdName(repo, slug),
+            prdName,
             tasks
-        });
-    }
+        };
+    }))).filter((input) => input !== null);
     const graph = buildGraphFromInputs(inputs);
     return {
         scope: 'repo',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thxgg/steward",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Local-first PRD workflow steward with codemode MCP and web UI.",
   "type": "module",
   "author": "thxgg",