@worca/app 1.5.0 → 1.6.0-rc.1

package/src/core/run-report.mjs

@@ -164,7 +164,8 @@ function templateShape(template, auto) {
   if (!template) return null;
   const id = template.id || '';
   const name = template.name || '';
-  const builtin = STOCK_WORKFLOW_NAMES.has(id) && auto?.via !== 'created';
+  // A classifier fallback records what it saved on `saved` (via is 'fallback').
+  const builtin = STOCK_WORKFLOW_NAMES.has(id) && auto?.via !== 'created' && auto?.saved !== 'created';
   const out = { builtin, id: builtin ? id : null };
   if (builtin) out.name = STOCK_WORKFLOW_NAMES.get(id) ?? '';
   else { out.id = id; out.name = name; }

package/src/core/settings.mjs

@@ -38,7 +38,8 @@
 // bootstrap value or a plain scalar toggle, so a table would buy nothing.
 //
 // IMPORTANT: this module imports NOTHING from the core graph (Node builtins
-// plus the zero-import model-env.mjs leaf only). projects.mjs imports it, so
+// plus the zero-import model-env.mjs leaf and the web-allowlist.mjs leaf, which
+// imports only node:net and node:url). projects.mjs imports it, so
 // importing projects.mjs back would make worcaHome() -> getWorcaRoot() ->
 // projects.mjs an infinite cycle.
 //
@@ -57,6 +58,7 @@ import {
   UPSTREAM_PROVIDERS, COPILOT_ACCOUNT_TYPES, DEFAULT_PROVIDER_CONCURRENCY, MAX_PROVIDER_CONCURRENCY,
   COPILOT_TERMS_VERSION, isUpstreamBaseUrl,
 } from './model-env.mjs';
+import { normalizeDomainList, normalizeDomainPattern, domainError, DOMAIN_LIST_MAX, RESERVED_KEY_VAR } from './web-allowlist.mjs';
 
 /**
  * The real OS home base, honoring HOME/USERPROFILE so tests can sandbox it.
@@ -568,8 +570,10 @@ export function assertCostLimitInputs(inputs = {}) {
 // dollar cap (--max-budget-usd). For the budget key the literal `null` is a
 // STORED value meaning "no cap" (the flag is omitted), while '' / undefined clear
 // the key back to the default — the two semantics the design assigns to that key.
-export const DEFAULT_ASK_MAX_TURNS = 40;
-export const DEFAULT_ASK_MAX_BUDGET_USD = 2;
+// The defaults are 400 turns and NO cost cap: the default budget is itself `null`,
+// so an absent or invalid stored budget also means "no cap".
+export const DEFAULT_ASK_MAX_TURNS = 400;
+export const DEFAULT_ASK_MAX_BUDGET_USD = null;
 
 const isAskMaxTurns = (v) => Number.isSafeInteger(v) && v >= 1 && v <= 500;
 const isAskMaxBudget = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0.1 && v <= 100;
@@ -583,13 +587,13 @@ export function askMaxTurns() {
   return DEFAULT_ASK_MAX_TURNS;
 }
 
-/** --max-budget-usd for one chat turn: number 0.1..100, or null = no cap; absent/invalid ⇒ the default (loudly). */
+/** --max-budget-usd for one chat turn: number 0.1..100, or null = no cap; absent/invalid ⇒ the default, no cap (loudly). */
 export function askMaxBudgetUsd() {
   const v = readSettings().askMaxBudgetUsd;
   if (v === undefined) return DEFAULT_ASK_MAX_BUDGET_USD;
   if (v === null) return null;
   if (isAskMaxBudget(v)) return v;
-  console.warn(`[worca] invalid askMaxBudgetUsd ${JSON.stringify(v)} — using the default (${DEFAULT_ASK_MAX_BUDGET_USD})`);
+  console.warn(`[worca] invalid askMaxBudgetUsd ${JSON.stringify(v)} — using the default (${DEFAULT_ASK_MAX_BUDGET_USD ?? 'no cap'})`);
   return DEFAULT_ASK_MAX_BUDGET_USD;
 }
 
@@ -630,6 +634,86 @@ export async function setAskMaxBudgetUsd(input) {
   return { askMaxBudgetUsd: askMaxBudgetUsd() };
 }
 
+// ── Ask Worca web access (docs/guardrails.md "Web access") ─────────────────────────────────
+// `askWeb` = { enabled, allowedDomains, search? }. Off by default; the allowlist is enforced by
+// worca's own MCP server (web-fetch.mjs). The search key is only ever a ${VAR} reference read from
+// worca's environment — a literal key is refused so settings.json never holds one.
+const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+
+function normalizeAskWebSearch(s) {
+  if (s === null || s === undefined || s === '') return null;
+  if (!isObj(s)) throw new Error('askWeb.search must be an object or null');
+  const url = typeof s.url === 'string' ? s.url.trim() : '';
+  if (!url) return null;                                     // an empty URL field = search off
+  let u; try { u = new URL(url.replace('{query}', 'q').replace('{key}', 'k')); } catch { throw new Error('askWeb.search.url is not a valid URL'); }
+  if (u.protocol !== 'https:') throw new Error('askWeb.search.url must be an https URL');
+  if (u.username || u.password) throw new Error('askWeb.search.url must not carry credentials');
+  if (!url.includes('{query}')) throw new Error('askWeb.search.url must contain {query}');
+  if (url.length > 500) throw new Error('askWeb.search.url is longer than 500 characters');
+  const key = typeof s.key === 'string' ? s.key.trim() : '';
+  const keyVar = key ? modelEnvRef(key) : null;
+  if (key && !keyVar) throw new Error('askWeb.search.key must be a ${VAR} reference — worca never stores a search API key in settings.json');
+  if (keyVar && RESERVED_KEY_VAR.test(keyVar)) throw new Error(`askWeb.search.key: ${keyVar} is a reserved variable name`);
+  const keyHeader = typeof s.keyHeader === 'string' ? s.keyHeader.trim() : '';
+  if (keyHeader && !/^[A-Za-z0-9-]{1,64}$/.test(keyHeader)) throw new Error('askWeb.search.keyHeader must be an HTTP header name');
+  const keyPrefix = typeof s.keyPrefix === 'string' ? s.keyPrefix : '';
+  if (keyPrefix.length > 20 || /[\r\n]/.test(keyPrefix)) throw new Error('askWeb.search.keyPrefix must be at most 20 characters on one line');
+  if ((keyHeader || url.includes('{key}')) && !keyVar) throw new Error('askWeb.search.key is required when a key header or {key} is used');
+  return { url, key, keyVar, keyHeader, keyPrefix };
+}
+
+/** Throws a 400-able message; returns the normalized value. */
+export function assertAskWebInput(input) {
+  if (!isObj(input)) throw new Error('askWeb must be an object');
+  if (typeof input.enabled !== 'boolean') throw new Error('askWeb.enabled must be true or false');
+  if (input.anyHost !== undefined && typeof input.anyHost !== 'boolean') throw new Error('askWeb.anyHost must be true or false');
+  if (!Array.isArray(input.allowedDomains)) throw new Error('askWeb.allowedDomains must be a list');
+  if (input.allowedDomains.length > DOMAIN_LIST_MAX) throw new Error(`askWeb.allowedDomains holds at most ${DOMAIN_LIST_MAX} entries`);
+  const { domains, invalid } = normalizeDomainList(input.allowedDomains);
+  if (invalid.length) throw new Error(`askWeb.allowedDomains: ${domainError(invalid[0])}`);
+  return { enabled: input.enabled, anyHost: input.anyHost === true, allowedDomains: domains, search: normalizeAskWebSearch(input.search) };
+}
+
+let askWebWarned = null;
+/** The local Ask web settings; invalid stored data falls back to off (never throws). */
+export function askWeb() {
+  const raw = readSettings().askWeb;
+  const off = { enabled: false, anyHost: false, allowedDomains: [], search: null };
+  if (raw === undefined || raw === null) return off;
+  try { return assertAskWebInput(isObj(raw) ? { enabled: raw.enabled, anyHost: raw.anyHost ?? false, allowedDomains: raw.allowedDomains ?? [], search: raw.search ?? null } : raw); }
+  catch (err) {
+    // Read on every turn and settings view: warn once per distinct problem, not on every read.
+    if (err.message !== askWebWarned) { askWebWarned = err.message; console.warn(`[worca] invalid askWeb setting (${err.message}) — web access stays off`); }
+    return off;
+  }
+}
+
+/** Stores exactly what the user saved; `null` clears the key (back to "unset" = off). */
+export async function setAskWeb(input) {
+  const settings = readSettings();
+  if (input === null) { delete settings.askWeb; await persistSettings(settings); return { askWeb: askWeb() }; }
+  const next = assertAskWebInput(input);
+  settings.askWeb = {
+    enabled: next.enabled,
+    ...(next.anyHost ? { anyHost: true } : {}),
+    allowedDomains: next.allowedDomains,
+    ...(next.search ? { search: { url: next.search.url, key: next.search.key, keyHeader: next.search.keyHeader, keyPrefix: next.search.keyPrefix } } : {}),
+  };
+  await persistSettings(settings);
+  return { askWeb: askWeb() };
+}
+
+/** The web card's "Always allow": one exact host joins the stored allowlist; everything else is kept. */
+export async function addAskWebHost(host) {
+  const h = normalizeDomainPattern(host);
+  if (!h || h.startsWith('*.')) throw new Error(`askWeb: "${host}" is not an exact host name`);
+  const cur = askWeb();
+  if (cur.allowedDomains.includes(h)) return { askWeb: cur };
+  const s = cur.search;
+  return setAskWeb({ enabled: cur.enabled, anyHost: cur.anyHost, allowedDomains: [...cur.allowedDomains, h],
+    search: s ? { url: s.url, key: s.key, keyHeader: s.keyHeader, keyPrefix: s.keyPrefix } : null });
+}
+
 /** Write (or clear) a USD cap key. @throws {Error} unless positive finite number (or empty). */
 async function setUsdCap(key, input) {
   assertUsdCapInput(key, input);
@@ -770,6 +854,7 @@ export const SETTINGS_POST_KEYS = Object.freeze([
   'root', 'projectsRoot', 'chat',
   'pipelineCostLimitUsd', 'totalCostLimitUsd', 'costLimitResetPeriod', 'humanRateUsdPerHour',
   'askMaxTurns', 'askMaxBudgetUsd',
+  'askWeb',                                  // Ask Worca web access { enabled, allowedDomains, search }
   'debugSpawnEnabled',
   'titleModel', 'hideBuiltinModels',
   'theme',

package/src/core/title.mjs

@@ -3,6 +3,7 @@ import { runClaude } from './claude-runner.mjs';
 import { resolveModelEnv, catalogHasModel } from './config.mjs';
 import { titleModel as storedTitleModel } from './settings.mjs';
 import { AUX_EFFORT } from './model-env.mjs';
+import { withRecoveryRetry } from './recovery-backoff.mjs';
 
 // The last-resort title model: the BUILT-IN Haiku id (config.mjs PREDEFINED_MODELS),
 // not the dated API id it used to be — a global entry that shadows the built-in
@@ -128,7 +129,10 @@ export async function generateTitle(prompt, opts = {}) {
     try { opts.onError({ model, error }); } catch { /* a logging sink must never fail the caller */ }
   };
   try {
-    const { text: out } = await runClaude({
+    // A provider 429 (a shared free pool) is retried with the recovery backoff;
+    // nothing else is — a title is cosmetic, and an unspawnable CLI (stamped
+    // network) would only make the run wait for it.
+    const { text: out } = await withRecoveryRetry(() => runClaude({
       cwd: opts.cwd || process.cwd(),
       systemPrompt: SYSTEM,
       prompt: `Write the title for this task:\n\n${text.slice(0, 4000)}`,
@@ -141,6 +145,7 @@ export async function generateTitle(prompt, opts = {}) {
       permissionMode: opts.permissionMode || 'acceptEdits',
       allowedTools: [],            // empty → no --allowedTools flag → claude defaults; pure text gen
       signal: opts.signal,
+      spawnKind: 'aux',            // credential broker: a short-lived token (broker-client.mjs)
       // Title generation runs DURING a pipeline run, so it must honor the same
       // guardrails as the run itself. All three are undefined when absent, and
       // runClaude treats undefined as "not passed" — existing callers are unchanged.
@@ -161,7 +166,7 @@ export async function generateTitle(prompt, opts = {}) {
       disableSlashCommands: opts.disableSlashCommands,
       mcpConfigPath: opts.mcpConfigPath,
       onEvent: () => {},
-    });
+    }), { classes: ['rate_limit'], signal: opts.signal });
     const title = sanitizeTitle(out);
     if (!title) { report(new Error('the model returned an empty reply')); return ''; }
     if (isRefusalTitle(title)) { report(new Error(`the model did not write a title: ${title.slice(0, 120)}`)); return ''; }

package/src/core/web-allowlist.mjs

@@ -0,0 +1,95 @@
+// Ask Worca web allowlist patterns: an exact host ("docs.example.com") or "*.example.com"
+// (subdomains only — add "example.com" too for the apex). Leaf module: settings, team policy
+// and the Ask MCP child all validate with the same rules.
+import { isIP } from 'node:net';
+import { domainToASCII } from 'node:url';
+
+export const DOMAIN_LIST_MAX = 200;
+/** The effective list of the "any public host" switch (settings askWeb.anyHost). Never a typed entry. */
+export const ANY_HOST = '*';
+/** Env var names a search-key `${VAR}` may never name (worca, Claude and runtime credentials). */
+export const RESERVED_KEY_VAR = /^(WORCA_|ORCH_|ANTHROPIC_|CLAUDE_|NODE_|PATH$|HOME$)/i; // case-insensitive: Windows env lookup is
+const LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
+// A wildcard over one of these would allow hosts that strangers own — and a stranger's host sees
+// every URL Ask requests from it. Not the whole Public Suffix List: the shared-hosting suffixes
+// people actually paste, plus the ccTLD second levels (co.uk, com.au, …) matched by shape below.
+const SHARED_SUFFIXES = new Set([
+  'github.io', 'githubusercontent.com', 'gitlab.io', 'bitbucket.io', 'vercel.app', 'now.sh', 'netlify.app', 'netlify.com',
+  'pages.dev', 'workers.dev', 'trycloudflare.com', 'herokuapp.com', 'onrender.com', 'fly.dev', 'railway.app', 'up.railway.app',
+  'web.app', 'firebaseapp.com', 'appspot.com', 'run.app', 'cloudfunctions.net', 'azurewebsites.net', 'azurestaticapps.net',
+  'blob.core.windows.net', 'cloudfront.net', 'amazonaws.com', 's3.amazonaws.com', 'ngrok.io', 'ngrok.app', 'ngrok-free.app',
+  'loca.lt', 'glitch.me', 'repl.co', 'replit.app', 'replit.dev', 'surge.sh', 'blogspot.com', 'wordpress.com', 'tumblr.com',
+  'deno.dev', 'val.run', 'codesandbox.io', 'csb.app', 'stackblitz.io', 'webcontainer.io', 'pythonanywhere.com', 'neocities.org',
+]);
+const CC_SECOND_LEVEL = new Set(['co', 'com', 'net', 'org', 'gov', 'edu', 'ac', 'or', 'ne', 'go', 'gob', 'gv', 'mil', 'nic', 'ltd', 'plc', 'sch', 'nom', 'info', 'biz']);
+const isSharedSuffix = (s) => {
+  if (SHARED_SUFFIXES.has(s)) return true;
+  const l = s.split('.');
+  return l.length === 2 && l[1].length === 2 && CC_SECOND_LEVEL.has(l[0]);
+};
+
+function parsePattern(raw) {
+  if (typeof raw !== 'string') return { error: 'bad' };
+  let s = raw.trim().toLowerCase().replace(/\.$/, '');
+  let wildcard = false;
+  if (s.startsWith('*.')) { wildcard = true; s = s.slice(2); }
+  if (!s || /[^a-z0-9.\-\u0080-￿]/.test(s)) return { error: 'bad' };
+  s = domainToASCII(s);
+  if (!s || s.length > 253 || isIP(s)) return { error: 'bad' };
+  const labels = s.split('.');
+  if (labels.length < 2 || !labels.every((l) => LABEL.test(l))) return { error: 'bad' };
+  if (/^\d+$/.test(labels.at(-1))) return { error: 'bad' };
+  if (wildcard && isSharedSuffix(s)) return { error: 'shared' };
+  return { pattern: wildcard ? `*.${s}` : s };
+}
+
+export function normalizeDomainPattern(raw) { return parsePattern(raw).pattern || null; }
+
+/** Why `raw` is not a usable allowlist entry, or null when it is. */
+export function domainError(raw) {
+  const r = parsePattern(raw);
+  if (r.pattern) return null;
+  return r.error === 'shared'
+    ? `"${raw}" covers a domain where anyone can host a site — list the exact host instead (e.g. name.${String(raw).trim().replace(/^\*\./, '')})`
+    : `"${raw}" is not a host name or *.host pattern`;
+}
+
+export function normalizeDomainList(list) {
+  const domains = []; const invalid = [];
+  for (const raw of Array.isArray(list) ? list : []) {
+    const d = normalizeDomainPattern(raw);
+    if (!d) invalid.push(String(raw));
+    else if (!domains.includes(d)) domains.push(d);
+  }
+  return { domains, invalid };
+}
+
+export function mergeDomainLists(...lists) {
+  return normalizeDomainList(lists.flatMap((l) => (Array.isArray(l) ? l : []))).domains;
+}
+
+/** The entries of `list` that `cap` fully covers; a null cap leaves the list as is. A wildcard
+ *  survives only under an equal-or-broader wildcard — an exact cap entry never covers one. */
+export function capDomainList(list, cap) {
+  const any = Array.isArray(list) && list.includes(ANY_HOST);
+  const mine = any ? [ANY_HOST] : normalizeDomainList(list).domains;
+  if (!Array.isArray(cap)) return mine;
+  const c = normalizeDomainList(cap).domains;
+  if (any) return c;                                // "any host" under a cap = exactly the cap
+  return mine.filter((p) => {
+    if (!p.startsWith('*.')) return hostAllowed(p, c);
+    const base = p.slice(2);
+    return c.some((q) => q.startsWith('*.') && (base === q.slice(2) || base.endsWith(`.${q.slice(2)}`)));
+  });
+}
+
+export function hostAllowed(host, patterns) {
+  const h = String(host ?? '').toLowerCase().replace(/\.$/, '');
+  if (!h) return false;
+  for (const p of patterns || []) {
+    if (p === ANY_HOST) return true;
+    if (p.startsWith('*.')) { if (h.endsWith(`.${p.slice(2)}`)) return true; }
+    else if (h === p) return true;
+  }
+  return false;
+}