@vincemakes/kiso-web 0.0.0-stage → 0.53.0

package/dist/main/host.js

@@ -0,0 +1,210 @@
+import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { appendFileSync, readFileSync } from "node:fs";
+import { basename, extname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { canonicalPath, claimProjectDir, projectDirFor, sessionFolders } from "@vincemakes/kiso-code/config";
+import { kisoHome } from "@vincemakes/kiso-runtime";
+import { Auth } from "./auth.js";
+import { ApprovalWatch } from "./approvals.js";
+import { deskApi } from "./desk-api.js";
+import { History } from "./history.js";
+import { Previews } from "./preview.js";
+import { createSpace } from "./space.js";
+export async function startHost(options) {
+    const token = options.token ?? randomBytes(32).toString("hex");
+    const home = options.home ?? kisoHome();
+    const spaces = new Map();
+    const spaceOptions = (key, workspace, dir, prefix) => ({
+        key,
+        workspace,
+        dir,
+        prefix,
+        model: (ctx) => options.settings.model(ctx),
+        tierOf: (sessionId) => options.settings.tierOf(sessionId),
+        checkRunners: () => options.settings.checks(),
+        secretEnvNames: options.settings.secretEnvNames(),
+        exposeThinking: options.exposeThinking ?? true,
+        sanitizer: options.sanitizer ?? "web",
+        ...(options.keepaliveMs !== undefined ? { keepaliveMs: options.keepaliveMs } : {}),
+        ...(options.toolLimits !== undefined ? { toolLimits: options.toolLimits } : {}),
+        followUps: options.followUps ?? true,
+        titles: options.titles ?? true,
+    });
+    // the folder in use: its directory is claimed (named after its path) the way the terminal claims it
+    const workspace = canonicalPath(options.workspace);
+    const currentDir = projectDirFor(home, workspace);
+    claimProjectDir(currentDir, workspace);
+    const current = createSpace(spaceOptions(basename(currentDir), workspace, currentDir, "/v1/sessions"));
+    spaces.set(current.key, current);
+    /** Another folder's space, made on first use; only a folder the listing names (a key is never a path). */
+    const spaceFor = (key) => {
+        const held = spaces.get(key);
+        if (held !== undefined)
+            return held;
+        const folder = sessionFolders(home).find((f) => f.kind === "project" && f.workspace !== null && basename(f.dir) === key);
+        if (folder === undefined || folder.workspace === null)
+            return null;
+        const space = createSpace(spaceOptions(key, folder.workspace, folder.dir, `/w/${key}/v1/sessions`));
+        spaces.set(key, space);
+        return space;
+    };
+    const history = new History(home, async (key, sessionId) => {
+        const space = spaces.get(key);
+        if (space === undefined || !space.service.isRunning(sessionId))
+            return "idle";
+        return (await space.service.pendingApprovals(sessionId)).length > 0 ? "waiting" : "running";
+    }, (id) => options.settings.marksOf(id));
+    const rendererDir = fileURLToPath(new URL("../../out/renderer/", import.meta.url));
+    const tokenBytes = Buffer.from(token);
+    let auth;
+    let presence = null;
+    const previews = new Previews(options.previewLog);
+    const requestLog = options.requestLog;
+    const watch = new ApprovalWatch(() => spaces.values(), options.notify, () => presence);
+    watch.start();
+    const desk = { home, settings: options.settings, current, history, spaceFor, setPresence: (p) => (presence = p), notices: (seq) => watch.since(seq), previews };
+    let origins = new Set();
+    let hosts = new Set();
+    const refuse = (res, status, message) => {
+        res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+        res.end(JSON.stringify({ code: "forbidden", message }));
+    };
+    const answer = (res, status, body, headers = {}) => {
+        res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", ...headers });
+        res.end(JSON.stringify(body));
+    };
+    /** The page's cookie, sent from the page itself: a request another page made (another port of 127.0.0.1 is the same site) says so in Sec-Fetch-Site. */
+    const cookieOk = (req) => {
+        const site = req.headers["sec-fetch-site"];
+        if (site !== undefined && site !== "same-origin" && site !== "none")
+            return false;
+        return auth?.signedIn(req) ?? false;
+    };
+    /** The sign-in doors: status (open; it also tells another `kiso-web` that this port is ours), connect (the page trades its code), code (scripts, by token). */
+    const authRoute = async (req, res, path) => {
+        if (path === "/auth/status" && req.method === "GET")
+            return answer(res, 200, { app: "kiso-web", signedIn: cookieOk(req) });
+        if (path === "/auth/connect" && req.method === "POST") {
+            // only our own page may trade a code: a browser always names the origin of a POST
+            if (!origins.has(req.headers.origin ?? ""))
+                return refuse(res, 403, "Origin not allowed");
+            let text = "";
+            for await (const chunk of req)
+                if ((text += chunk).length > 1024)
+                    return refuse(res, 413, "too large");
+            let code;
+            try {
+                code = JSON.parse(text).code;
+            }
+            catch {
+                code = undefined;
+            }
+            const cookie = auth?.connect(code) ?? null;
+            return cookie === null ? refuse(res, 401, "the connect code is unknown, used or expired: run kiso web") : answer(res, 200, { ok: true }, { "set-cookie": cookie });
+        }
+        if (path === "/auth/code" && req.method === "POST")
+            return bearerOk(req) ? answer(res, 200, { code: auth.code() }) : refuse(res, 401, "missing or wrong token");
+        res.writeHead(404);
+        res.end();
+    };
+    const bearerOk = (req) => {
+        const header = req.headers.authorization ?? "";
+        if (!header.startsWith("Bearer "))
+            return false;
+        const given = Buffer.from(header.slice(7));
+        return given.length === tokenBytes.length && timingSafeEqual(given, tokenBytes);
+    };
+    const TYPES = { ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".svg": "image/svg+xml", ".woff2": "font/woff2", ".png": "image/png", ".webmanifest": "application/manifest+json" };
+    /** A file of the bundled renderer, by URL path; nothing outside its folder is served. */
+    const serveStatic = (res, pathname) => {
+        const full = resolve(rendererDir, pathname === "/" ? "index.html" : `.${pathname}`);
+        const type = TYPES[extname(full)];
+        try {
+            if (type === undefined || !full.startsWith(rendererDir))
+                throw new Error("not served");
+            const body = readFileSync(full);
+            // the page runs its own bundle and talks to its own origin, nothing else
+            res.writeHead(200, {
+                "content-type": type,
+                "cache-control": "no-store",
+                "x-content-type-options": "nosniff",
+                "content-security-policy": "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data: https:; media-src http://localhost:* http://127.0.0.1:*; manifest-src 'self'; frame-src http://localhost:* http://127.0.0.1:*; base-uri 'none'; form-action 'none'",
+            });
+            res.end(body);
+        }
+        catch {
+            res.writeHead(404);
+            res.end();
+        }
+    };
+    const server = createServer((req, res) => {
+        void (async () => {
+            // DNS rebinding: a name that resolves to 127.0.0.1 but is not ours
+            if (!hosts.has(req.headers.host ?? ""))
+                return refuse(res, 403, "unknown Host");
+            // the proofs read which requests reached the host, and from where
+            if (requestLog !== undefined)
+                appendFileSync(requestLog, `${req.method} ${req.url} site=${req.headers["sec-fetch-site"] ?? "-"} origin=${req.headers.origin ?? "-"} cookie=${(req.headers.cookie ?? "").includes("kiso_web_") ? "yes" : "no"}\n`);
+            const url = new URL(req.url ?? "/", "http://localhost");
+            const origin = req.headers.origin;
+            if (origin !== undefined && !origins.has(origin))
+                return refuse(res, 403, "Origin not allowed");
+            if (url.pathname.startsWith("/auth/"))
+                return authRoute(req, res, url.pathname);
+            const other = /^\/w\/([A-Za-z0-9._-]+)\/v1\//.exec(url.pathname);
+            if (!url.pathname.startsWith("/v1/") && other === null && !url.pathname.startsWith("/desk/")) {
+                if (req.method !== "GET") {
+                    res.writeHead(405);
+                    return void res.end();
+                }
+                return serveStatic(res, url.pathname);
+            }
+            if (!bearerOk(req) && !cookieOk(req))
+                return refuse(res, 401, "not signed in: run kiso web");
+            if (url.pathname.startsWith("/desk/")) {
+                const answer = await deskApi(desk, req, url);
+                if (Buffer.isBuffer(answer.body) || answer.body === null) {
+                    res.writeHead(answer.status, answer.headers);
+                    return void res.end(answer.body ?? undefined);
+                }
+                res.writeHead(answer.status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+                return void res.end(JSON.stringify(answer.body));
+            }
+            const space = other === null ? current : spaceFor(other[1]);
+            if (space === null || !(await space.handler.handle(req, res))) {
+                res.writeHead(404);
+                res.end();
+            }
+        })().catch(() => {
+            if (!res.headersSent)
+                res.writeHead(500);
+            res.end();
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port ?? 0, "127.0.0.1", resolve);
+    });
+    const port = server.address().port;
+    origins = new Set([`http://127.0.0.1:${port}`, `http://localhost:${port}`]);
+    hosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+    auth = new Auth(home, port);
+    let closed = false;
+    const close = async (graceMs = 5_000) => {
+        if (closed)
+            return;
+        closed = true;
+        // the order that keeps every run resumable (packages/server README):
+        // drain, stop the listener, close the stores
+        await Promise.all([...spaces.values()].map((space) => space.drain(graceMs)));
+        server.closeAllConnections();
+        await new Promise((resolve) => server.close(() => resolve()));
+        watch.stop();
+        previews.closeAll();
+        history.close();
+        for (const space of spaces.values())
+            await space.close();
+    };
+    return { origin: `http://127.0.0.1:${port}`, port, token, connectCode: () => auth.code(), service: current.service, store: current.store, tasks: current.tasks, current: { key: current.key, workspace }, close };
+}

package/dist/main/login.js

@@ -0,0 +1,27 @@
+import { KNOWN_PROVIDERS, endpointCredentialId, providerIdOf, setCredential } from "@vincemakes/kiso-code/config";
+import { Refusal } from "./files.js";
+/**
+ * Storing a key for a profile, through the terminal's own credential door (`setCredential`: the same `auth.json`, the same single write
+ * path). The key arrives from the page once, is written, and is never answered, logged or put in an error: every message here is fixed text.
+ */
+const MIN_KEY = 8;
+const MAX_KEY = 4096;
+/** The store id a profile's key belongs under: its vendor, else its gateway's origin; null for a profile that has no place for a key. */
+export function credentialIdFor(profile) {
+    return providerIdOf(profile.kind, profile.baseUrl) ?? endpointCredentialId(profile.baseUrl);
+}
+export function storeKey(profile, key) {
+    if (profile === undefined)
+        throw new Refusal(404, "no such profile");
+    if (typeof key !== "string" || key.length < MIN_KEY || key.length > MAX_KEY || !/^\S+$/.test(key))
+        throw new Refusal(400, "that does not look like a key");
+    const id = credentialIdFor(profile);
+    if (id === null)
+        throw new Refusal(400, "this profile has no place for a key");
+    // a ChatGPT sign-in is an OAuth flow with a browser: it stays in the terminal for now
+    if (id === "chatgpt")
+        throw new Refusal(400, "this sign-in is done in the terminal: kiso login chatgpt");
+    if (!id.startsWith("endpoint:") && !KNOWN_PROVIDERS.includes(id))
+        throw new Refusal(400, "unknown provider");
+    setCredential(id, { type: "api-key", key, savedAt: Date.now() });
+}

package/dist/main/names.js

@@ -0,0 +1,15 @@
+import { readSessionName, writeSessionName } from "@vincemakes/kiso-runtime/internal";
+/** A Work's name: the runtime's own session-name store, the one the terminal's rename writes (a file beside the log, never the log).
+ *  The runtime's titles read it (the listing re-reads a folder whose name file changed); empty clears it; at most 120 characters. */
+export function rename(dir, sessionId, name) {
+    const clean = name.replace(/\s+/g, " ").trim().slice(0, 120);
+    writeSessionName(dir, sessionId, clean === "" ? null : clean);
+    return clean === "" ? null : clean;
+}
+/** Whether a Work has a name: the person's, or a title written before. */
+export const named = (dir, sessionId) => readSessionName(dir, sessionId) !== null;
+/** A title made from the Work's first message, kept only while the Work is still unnamed: the person's name wins. */
+export function titleIfUnnamed(dir, sessionId, title) {
+    if (title !== "" && !named(dir, sessionId))
+        writeSessionName(dir, sessionId, title);
+}

package/dist/main/observed-revision.js

@@ -0,0 +1,69 @@
+import { realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { projectMessages } from "@vincemakes/kiso-core";
+import { readShowsWholeFile } from "@vincemakes/kiso-tools-node";
+/**
+ * The hidden observed revision: with it, edit_file and write_file take no
+ * expectedRevision and the file's latest `[rev:…]` is read off the
+ * session's own log — what the model last observed of that file. The same
+ * rule the terminal product applies (apps/cli state.ts, observedRevisionFromLog),
+ * rewritten over the public store and projection instead of the log file.
+ */
+function real(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+export function observedRevisionFrom(store, workspace) {
+    return (sessionId, full, kind = "edit") => {
+        if (sessionId === undefined)
+            return undefined;
+        let messages;
+        try {
+            messages = projectMessages(store.load(sessionId).map((r) => r.event));
+        }
+        catch {
+            return undefined;
+        }
+        const target = real(full);
+        const calls = new Map();
+        let rev;
+        let wholeKnown = false;
+        for (const m of messages) {
+            if (m.role === "assistant") {
+                for (const b of m.blocks) {
+                    if (b.type === "tool_use" && typeof b.input.path === "string") {
+                        calls.set(b.callId, { name: b.name, full: real(resolve(workspace, b.input.path)), input: b.input });
+                    }
+                }
+            }
+            else if (m.role === "tool") {
+                const c = calls.get(m.callId);
+                if (c === undefined || c.full !== target)
+                    continue;
+                const body = typeof m.content === "string" ? m.content : m.content.map((x) => (x.type === "text" ? x.text : "")).join("");
+                const hit = [...body.matchAll(/\[(rev:[0-9a-f]{16})\]/g)].pop();
+                if (hit === undefined)
+                    continue;
+                if (!m.isError && (c.name === "read_file" || c.name === "edit_file" || c.name === "write_file")) {
+                    const sameRevision = hit[1] === rev;
+                    rev = hit[1];
+                    if (c.name === "read_file")
+                        wholeKnown = readShowsWholeFile(c.input, body) || (wholeKnown && sameRevision);
+                    else if (c.name === "write_file")
+                        wholeKnown = true;
+                }
+                else if (m.isError && c.name === "edit_file" && body.includes(" changed since ")) {
+                    rev = hit[1];
+                    wholeKnown = false;
+                }
+            }
+        }
+        if (kind === "write" && !wholeKnown)
+            return undefined;
+        return rev;
+    };
+}

package/dist/main/preview.js

@@ -0,0 +1,141 @@
+import { appendFileSync, createReadStream, realpathSync, statSync } from "node:fs";
+import { createServer } from "node:http";
+import { basename, dirname, extname, join, sep } from "node:path";
+/**
+ * Page previews. A page the model wrote is untrusted: it must reach neither the host (which can run commands) nor the folder's
+ * other files, nor services on this machine. So each preview gets its own server, on a random port under the OTHER loopback name
+ * than the page's (the page on 127.0.0.1: the preview on localhost), so the browser never sends it the kiso cookie and it is
+ * another origin. Its root is the entry file's own directory. It refuses anything outside it, every dot-file and dot-directory,
+ * key-like names and node_modules; GET and HEAD only, no listings. Every response carries a CSP sandbox (an opaque origin that
+ * may run scripts) that lets the page load https and its own files and reach no http address. It closes ten minutes after its
+ * last request, or when the panel closes it. The panel frames it with sandbox="allow-scripts" only.
+ */
+const IDLE_MS = 10 * 60_000;
+const KEYLIKE = /\.(pem|key|p12|pfx|crt|cer|der|asc|gpg|kdbx|keystore|jks)$|^id_|^credentials|^secrets?(\.|$)/i;
+const TYPES = {
+    ".html": "text/html; charset=utf-8", ".htm": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8", ".json": "application/json", ".svg": "image/svg+xml", ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg",
+    ".gif": "image/gif", ".webp": "image/webp", ".ico": "image/x-icon", ".woff": "font/woff", ".woff2": "font/woff2", ".ttf": "font/ttf", ".wasm": "application/wasm",
+    ".pdf": "application/pdf", ".mp4": "video/mp4", ".webm": "video/webm", ".mov": "video/quicktime", ".mp3": "audio/mpeg", ".wav": "audio/wav",
+    ".txt": "text/plain; charset=utf-8", ".md": "text/plain; charset=utf-8", ".csv": "text/plain; charset=utf-8",
+};
+/** Why a path inside the root is refused, or null. */
+export function refusedName(rel) {
+    const parts = rel.split("/").filter((p) => p !== "");
+    if (parts.some((p) => p.startsWith(".")))
+        return "dot-file";
+    if (parts.includes("node_modules"))
+        return "node_modules";
+    if (KEYLIKE.test(parts.at(-1) ?? ""))
+        return "key-like name";
+    return null;
+}
+export class Previews {
+    #open = new Map();
+    /** a file each request is written to, with its answer (the proofs read it) */
+    #log;
+    constructor(log) {
+        this.#log = log;
+    }
+    /** The address of `entry` (a file's real path) on its directory's preview server, started if there is none. `ancestor`: the page's origin, the one that may frame it. */
+    async open(entry, pageHost, ancestor) {
+        const name = pageHost.startsWith("localhost") ? "127.0.0.1" : "localhost";
+        const root = dirname(entry);
+        const key = `${name} ${ancestor} ${root}`;
+        const preview = this.#open.get(key) ?? (await this.#start(key, root, name, ancestor));
+        this.#touch(key, preview);
+        return `http://${name}:${preview.port}/${encodeURIComponent(basename(entry))}`;
+    }
+    /** Close the preview that serves `url` (its panel closed). */
+    close(url) {
+        for (const [key, p] of this.#open)
+            if (url.startsWith(`http://${p.name}:${p.port}/`))
+                this.#stop(key, p);
+    }
+    closeAll() {
+        for (const [key, p] of this.#open)
+            this.#stop(key, p);
+    }
+    #stop(key, p) {
+        if (p.timer !== null)
+            clearTimeout(p.timer);
+        this.#open.delete(key);
+        p.server.closeAllConnections();
+        p.server.close();
+    }
+    #touch(key, p) {
+        if (p.timer !== null)
+            clearTimeout(p.timer);
+        p.timer = setTimeout(() => this.#stop(key, p), IDLE_MS);
+        p.timer.unref();
+    }
+    async #start(key, root, name, ancestor) {
+        const headers = {
+            "content-security-policy": `sandbox allow-scripts; default-src 'self' 'unsafe-inline' https: data: blob:; connect-src 'self' https:; frame-ancestors ${ancestor}`,
+            "x-content-type-options": "nosniff",
+            "access-control-allow-origin": "*",
+            "cache-control": "no-store",
+            "referrer-policy": "no-referrer",
+        };
+        const server = createServer((req, res) => {
+            this.#touch(key, preview);
+            const end = (status, why) => {
+                if (this.#log !== undefined)
+                    appendFileSync(this.#log, `${req.method} ${req.url} ${status} ${why}\n`);
+                res.writeHead(status, headers);
+                res.end();
+            };
+            if (req.headers.host !== `${name}:${preview.port}`)
+                return end(403, "unknown Host");
+            if (req.method !== "GET" && req.method !== "HEAD")
+                return end(405, "GET and HEAD only");
+            let rel;
+            try {
+                rel = decodeURIComponent(new URL(req.url ?? "/", "http://x").pathname);
+            }
+            catch {
+                return end(400, "bad path");
+            }
+            if (rel.split("/").every((p) => p === ""))
+                return end(404, "no listing");
+            const why = refusedName(rel);
+            if (why !== null)
+                return end(403, why);
+            let real;
+            try {
+                real = realpathSync(join(root, rel));
+            }
+            catch {
+                return end(404, "no such file");
+            }
+            // a link may lead out of the root, or into a dot-directory inside it
+            if (!real.startsWith(root + sep))
+                return end(403, "outside the root");
+            const inner = refusedName(real.slice(root.length + 1));
+            if (inner !== null)
+                return end(403, inner);
+            const stat = statSync(real);
+            if (!stat.isFile())
+                return end(404, "no listing");
+            const type = TYPES[extname(real).toLowerCase()] ?? "application/octet-stream";
+            // a range, for media (Safari plays video only by ranges)
+            const range = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range ?? "");
+            const first = range === null ? 0 : range[1] === "" ? Math.max(0, stat.size - Number(range[2])) : Number(range[1]);
+            const last = range === null || range[2] === "" || range[1] === "" ? stat.size - 1 : Math.min(stat.size - 1, Number(range[2]));
+            if (this.#log !== undefined)
+                appendFileSync(this.#log, `${req.method} ${req.url} ${range === null ? 200 : 206} served\n`);
+            res.writeHead(range === null ? 200 : 206, { ...headers, "content-type": type, "content-length": String(Math.max(0, last - first + 1)), "accept-ranges": "bytes", ...(range === null ? {} : { "content-range": `bytes ${first}-${last}/${stat.size}` }) });
+            if (req.method === "HEAD" || last < first)
+                return void res.end();
+            createReadStream(real, { start: first, end: last }).pipe(res);
+        });
+        const preview = { root, name, server, port: 0, timer: null };
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, name, resolve);
+        });
+        preview.port = server.address().port;
+        this.#open.set(key, preview);
+        return preview;
+    }
+}

package/dist/main/sanitize.js

@@ -0,0 +1,28 @@
+/**
+ * The web app's own tool-argument sanitizer. The default one is a filter
+ * for a hosted product's tool card (it drops prose keys and cuts strings at
+ * 200 characters); the person on the other end of this stream is the
+ * person whose files these are, and a diff needs the whole of oldText and
+ * newText. So keys stay and strings are only capped at a size no edit
+ * comes near, to keep one frame from carrying a whole generated file.
+ *
+ * The projection hands the sanitizer the arguments alone, never the tool's
+ * name, so it cannot treat `edit_file` differently from `shell`: the cap is
+ * the same for every tool.
+ */
+export const WEB_MAX_ARG_CHARS = 32_768;
+const MAX_DEPTH = 8;
+export function webSanitize(input, depth = 0) {
+    if (typeof input === "string")
+        return input.length > WEB_MAX_ARG_CHARS ? `${input.slice(0, WEB_MAX_ARG_CHARS)}…[${input.length - WEB_MAX_ARG_CHARS} more chars]` : input;
+    if (input === null || typeof input !== "object")
+        return input;
+    if (depth >= MAX_DEPTH)
+        return Array.isArray(input) ? "[…]" : "{…}";
+    if (Array.isArray(input))
+        return input.map((v) => webSanitize(v, depth + 1));
+    const out = {};
+    for (const [key, value] of Object.entries(input))
+        out[key] = webSanitize(value, depth + 1);
+    return out;
+}