@wrongstack/webui-server 0.297.0 → 0.298.0

package/dist/server/frontend-static-serve.d.ts

@@ -59,6 +59,13 @@ export interface StaticServeOptions {
     apiToken?: string | undefined;
     /** Force token auth even when the server binds to loopback. */
     requireToken?: boolean | undefined;
+    /**
+     * Extra hostnames the HTTP CSRF/DNS-rebinding guard accepts, for operators
+     * fronting the WebUI with a tunnel or reverse proxy. `publicWsUrl`'s hostname
+     * is trusted implicitly; set this when the browser-facing HTTP origin differs
+     * from it (WS-001).
+     */
+    allowedHostnames?: readonly string[] | undefined;
     /**
      * When true, skip `server.listen()` — the caller is responsible for
      * calling listen after attaching the WebSocketServer. This prevents

package/dist/server/governance-runtime.d.ts

@@ -0,0 +1,30 @@
+import type { AgentPipelines } from '@wrongstack/core/agent';
+import type { EventBus } from '@wrongstack/core/kernel';
+import type { Logger, WorkspaceCheckpointRef } from '@wrongstack/core/types';
+import type { BootstrapGovernanceRuntimeOptions, GovernanceRuntimeBootstrapCloseResult, GovernanceRuntimeBootstrapResult } from '@wrongstack/runtime/governance-bootstrap';
+import { createGovernanceMutationSnapshotBridge } from '@wrongstack/runtime/governance-mutation-snapshot-bridge';
+export declare const WRONGSTACK_GOVERNANCE_ENV = "WRONGSTACK_GOVERNANCE";
+interface GovernanceBootstrapModule {
+    bootstrapGovernanceRuntime(options: BootstrapGovernanceRuntimeOptions): Promise<GovernanceRuntimeBootstrapResult>;
+}
+interface WebUiGovernanceDependencies {
+    readonly load: () => Promise<GovernanceBootstrapModule>;
+    readonly createMutationBridge: typeof createGovernanceMutationSnapshotBridge;
+}
+export interface WebUiGovernanceRuntimeHandle {
+    installToolBoundary(pipelines: AgentPipelines): void;
+    close(): Promise<GovernanceRuntimeBootstrapCloseResult>;
+}
+export declare function webUiGovernanceRuntimeEnabled(environment: Readonly<Record<string, string | undefined>>): boolean;
+export declare function setupWebUiGovernance(input: {
+    readonly environment: Readonly<Record<string, string | undefined>>;
+    readonly projectRoot: string;
+    readonly projectId: string;
+    readonly sessionId: string;
+    readonly contextMeta: Record<string, unknown>;
+    readonly events: EventBus;
+    readonly logger: Pick<Logger, 'info' | 'warn'>;
+    readonly captureWorkspaceCheckpoint: () => Promise<WorkspaceCheckpointRef | undefined>;
+}, dependencies?: WebUiGovernanceDependencies): Promise<WebUiGovernanceRuntimeHandle | undefined>;
+export {};
+//# sourceMappingURL=governance-runtime.d.ts.map

package/dist/server/http-server.d.ts

@@ -27,6 +27,13 @@ export interface CreateHttpServerOptions {
     apiToken?: string | undefined;
     /** Force HTTP token auth even on loopback binds, useful behind public tunnels. */
     requireToken?: boolean | undefined;
+    /**
+     * Extra `Host`/`Origin` hostnames accepted by the CSRF/rebinding guard, for
+     * operators fronting the WebUI with a tunnel or reverse proxy. The hostname
+     * of `publicWsUrl` is trusted implicitly. Mirrors the WS path's
+     * `allowedHostnames` (see ws-auth.ts).
+     */
+    allowedHostnames?: readonly string[] | undefined;
     /**
      * If true, the `/ws-auth` endpoint exchanges a `?token=` query param (or
      * `X-WS-Token` header) for an `HttpOnly` auth cookie. The cookie is then

package/dist/server/mcp-handlers.d.ts

@@ -8,7 +8,7 @@
  * config IO, url/header persistence, and live registry start/stop logic lives
  * there; here we only map structured results to WS events the browser expects.
  */
-import { type MCPRegistry, type MCPServerOperationalHealth } from '@wrongstack/mcp';
+import { type MCPRegistry, type MCPServerOperationalHealth, type McpServerInfo } from '@wrongstack/mcp';
 import type { WebSocket } from 'ws';
 import type { WSClientMessage } from './types.js';
 /** Wire view of a server as the browser MCP panel consumes it. */
@@ -28,6 +28,8 @@ export interface MCPServerView {
     url?: string;
     health?: MCPServerOperationalHealth;
 }
+/** Project the shared {@link McpServerInfo} into the browser wire shape. */
+export declare function toView(info: McpServerInfo, health?: MCPServerOperationalHealth | undefined): MCPServerView;
 /** mcp.list — configured servers merged with live registry status + tools. */
 export declare function handleMcpList(ws: WebSocket, _msg: WSClientMessage, globalConfigPath: string, mcpRegistry?: MCPRegistry): Promise<void>;
 /** mcp.add — persist a new server (incl. url/headers) and start it if enabled. */

package/dist/server/memory-handlers.d.ts

@@ -67,9 +67,9 @@ export declare function handleSageRemember(ws: WebSocket, msg: unknown, memorySt
  * Request:  { type: 'memory.sage.delete', payload: { id, reason?, force?, neverInject? } }
  * Response: { type: 'memory.sage.delete', payload: { success, message } }
  *
- * `force` defaults to `true` (backward-compatible). When `false`, the
- * permanent-memory guard in `deleteSage` is respected and
- * `persistence: 'permanent'` entries cannot be deleted.
+ * `force` defaults to `false`. The caller must explicitly pass `force: true`
+ * to authorize deletion. The permanent-memory guard in `deleteSage` is
+ * always respected when force is not set.
  *
  * `neverInject` (default false) marks the memory so context injection
  * never loads it — used when a memory is factually wrong, not just

package/dist/server/pending-confirms.d.ts

@@ -1,6 +1,15 @@
 export type ConfirmDecision = 'yes' | 'no' | 'always' | 'deny';
 export interface PendingConfirm {
     resolve: (decision: ConfirmDecision) => void;
+    /**
+     * Session this prompt belongs to. `pendingConfirms` is one process-wide map
+     * replayed to every connected client, and the resolver keyed only on a
+     * client-supplied id — with a session check that no-op'd whenever the client
+     * omitted `sessionId`. So any client could answer any session's prompt
+     * (WS-082). Recorded here so ownership is checked against the server's own
+     * record rather than against whatever the client chose to send.
+     */
+    sessionId?: string | undefined;
     decisionSource?: string | undefined;
     riskTier?: 'safe' | 'standard' | 'destructive' | undefined;
     boundaryReason?: string | undefined;

package/dist/server/sdd-board-ws-handler.d.ts

@@ -48,6 +48,7 @@ export declare class SddBoardWebSocketHandler {
     private poll;
     private pollInFlight;
     private unsub;
+    private disposed;
     constructor(boardsDir: string, events?: EventBus, lifecycle?: SddBoardLifecycleDeps, security?: SddBoardSecurityDeps);
     addClient(ws: WebSocket): void;
     handleMessage(msg: SddBoardWSMessage): Promise<void>;

package/dist/server/sdd-wizard-ws-handler.d.ts

@@ -85,11 +85,13 @@ export declare class SddWizardWebSocketHandler {
      * flight (or after the probe has settled).
      */
     private resumeProbe;
+    private disposed;
     constructor(deps: SddWizardDeps);
     private bootstrap;
     /** Rehydrate a persisted interview if one exists. */
     private tryResume;
     addClient(ws: WebSocket): void;
+    dispose(): void;
     handleMessage(msg: WizardMessage): Promise<void>;
     private parseRunOpts;
     private onStart;

package/dist/server/specs-ws-handler.d.ts

@@ -19,6 +19,7 @@ export declare class SpecsWebSocketHandler {
     private clients;
     constructor(specsDir: string, taskGraphsDir: string);
     addClient(ws: WebSocket): void;
+    dispose(): void;
     handleMessage(msg: SpecsWSMessage): Promise<void>;
     private buildList;
     private broadcastList;

package/dist/server/types.d.ts

@@ -2,7 +2,7 @@ import type { WebSocket } from 'ws';
 import type { TrustBoundary } from '@wrongstack/core/security';
 import type { ConfigStore, ModelsRegistry, SecretVault, SessionStore } from '@wrongstack/core/types';
 import type { JournalEntry } from '@wrongstack/core/storage';
-import type { Agent } from '@wrongstack/core/agent';
+import type { Agent, AgentPipelines } from '@wrongstack/core/agent';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { ToolRegistry } from '@wrongstack/core/registry';
 /** Compatibility envelope; new boundaries should decode to CanonicalServerMessage. */
@@ -20,6 +20,8 @@ export interface WebUIOptions {
     surface?: 'webui' | 'simpleui' | undefined;
     /** Policy authority for terminal/process/native-shell actions. */
     trustBoundary?: TrustBoundary | undefined;
+    /** Trusted host-only hook installed around leader and light-subagent tools. */
+    installToolBoundary?: ((pipelines: AgentPipelines) => void) | undefined;
     /** HTTP frontend port. Prefer `httpPort`; `port` is kept for compatibility. */
     port?: number | undefined;
     /** HTTP frontend port. */

package/dist/server/ws-auth.d.ts

@@ -42,6 +42,30 @@ export declare function hostHeaderOk(input: {
     wsHost: string;
     allowedHostnames?: readonly string[] | undefined;
 }): boolean;
+/**
+ * CSRF / drive-by guard for the HTTP surface (WS-001).
+ *
+ * The WebSocket upgrade path has always been Origin- and Host-checked, but the
+ * plain HTTP `/api/*` surface was not: it built its URL from a hardcoded base,
+ * never read `Origin`, and (on the default loopback bind) required no token. A
+ * `POST` with `Content-Type: text/plain` is a CORS *simple request*, so any page
+ * the user visits could fire one without a preflight — the response being
+ * unreadable does not undo the side effect.
+ *
+ * Policy, mirroring `hasTrustedBrowserOrigin` in the HQ server:
+ *  - the `Host` authority must already be trusted (DNS-rebinding guard), and
+ *  - when the browser sends `Origin`, it must name that same authority.
+ *
+ * A missing `Origin` is allowed: same-origin top-level navigations and
+ * non-browser clients (curl, the CLI, tests) legitimately omit it, and those
+ * cannot be driven by a hostile page.
+ */
+export declare function httpRequestOriginOk(input: {
+    origin: string | undefined;
+    hostHeader: string | undefined;
+    wsHost: string;
+    allowedHostnames?: readonly string[] | undefined;
+}): boolean;
 export interface VerifyClientInput {
     /** Browser `Origin` header, or undefined for non-browser clients. */
     origin?: string | undefined;

package/dist/server/ws-payload-validation.d.ts

@@ -140,4 +140,22 @@ interface ProjectsSelectPayload {
     name?: string;
 }
 export declare function validateProjectsSelectPayload(payload: unknown): PayloadValidationResult<ProjectsSelectPayload>;
+/**
+ * `mcp.add` / `mcp.update` payload.
+ *
+ * WS-004: these handlers cast the raw WS payload with `as McpServerInput` and
+ * passed it straight to `addMcp`, which persists `command`/`args`/`env` to the
+ * global config and spawns them — so an unvalidated frame became a persistent
+ * child process that respawns on every restart. Validate the shape and the
+ * types before anything reaches disk.
+ *
+ * This checks structure, not policy: `command` is still whatever the operator
+ * configures. The spawn itself is hardened separately by
+ * `buildWin32CmdShimInvocation` (CMDI-005).
+ */
+export interface McpServerPayload {
+    name: string;
+    [key: string]: unknown;
+}
+export declare function validateMcpServerPayload(payload: unknown, label: string): PayloadValidationResult<McpServerPayload>;
 //# sourceMappingURL=ws-payload-validation.d.ts.map

package/dist/server/ws-utils.d.ts

@@ -25,7 +25,18 @@ export declare function broadcast(clients: Map<WebSocket, ConnectedClient>, msg:
  */
 export declare function sendResult(ws: WebSocket, success: boolean, message: string): void;
 /**
- * Extract a human-readable message from an unknown thrown value.
+ * Extract a human-readable message from an unknown thrown value, safe to put
+ * in a frame that leaves the process.
+ *
+ * WS-066: this was `err instanceof Error ? err.message : String(err)` — the
+ * verbatim throw. A provider that echoes an `Authorization` header back in its
+ * error body, or a connection string with an inline password, went straight to
+ * the browser and into whatever the browser logs. {@link scrubErrorDetail}
+ * keeps the message (this is a local dev tool; opaque errors would gut it) but
+ * removes credentials and rewrites the home directory to `~`.
+ *
+ * For HTTP `/api/*` JSON bodies — a less authenticated surface — use
+ * `sanitizeApiError` instead, which returns a category and nothing else.
  */
 export declare function errMessage(err: unknown): string;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/webui-server",
-  "version": "0.297.0",
+  "version": "0.298.0",
   "license": "MIT",
   "description": "WrongStack WebUI HTTP/WebSocket server module — extracted from @wrongstack/webui in PR #243/244 to remove the CLI -> @wrongstack/webui/server cross-package edge (audit §3.1.1). Pure backend: HTTP routes, WebSocket handlers, MCP tool wrappers, HTML serving. The web frontend lives in @wrongstack/webui; this package is the standalone server it can run on.",
   "keywords": [
@@ -35,19 +35,20 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "dist"
+    "dist",
+    "!dist/**/*.map"
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@wrongstack/core": "0.297.0",
-    "@wrongstack/mcp": "0.297.0",
-    "@wrongstack/runtime": "0.297.0",
-    "@wrongstack/techstack": "0.297.0",
-    "@wrongstack/sdd": "0.297.0",
-    "@wrongstack/providers": "0.297.0",
-    "@wrongstack/kanban": "0.297.0",
-    "@wrongstack/sage": "0.297.0",
-    "@wrongstack/tools": "0.297.0"
+    "@wrongstack/core": "0.298.0",
+    "@wrongstack/runtime": "0.298.0",
+    "@wrongstack/sdd": "0.298.0",
+    "@wrongstack/kanban": "0.298.0",
+    "@wrongstack/mcp": "0.298.0",
+    "@wrongstack/techstack": "0.298.0",
+    "@wrongstack/providers": "0.298.0",
+    "@wrongstack/sage": "0.298.0",
+    "@wrongstack/tools": "0.298.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}