@wrongstack/webui-server 0.308.7 → 0.309.1

package/dist/index.js

@@ -8983,7 +8983,7 @@ function verifyClient(input) {
 
 // src/server/http-server/api-router.ts
 import * as v8 from "node:v8";
-import { sanitizeApiError as sanitizeApiError3 } from "@wrongstack/core/security";
+import { sanitizeApiError as sanitizeApiError4 } from "@wrongstack/core/security";
 import { getIndexState as getIndexState2 } from "@wrongstack/tools";
 
 // src/server/codemap-handlers.ts
@@ -9589,6 +9589,7 @@ async function handleRequirementIntakeArchive(res, service, intakeId) {
 
 // src/server/techstack-handlers.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
+import { sanitizeApiError } from "@wrongstack/core/security";
 var DEEP_DIVE_TIMEOUT_MS = 6e4;
 function sendJson3(res, status, data) {
   res.writeHead(status, { "Content-Type": "application/json" });
@@ -9618,7 +9619,7 @@ function handleTechStackSnapshot(res, deps2) {
   }
 }
 function errorMessage(error2) {
-  return error2 instanceof Error ? error2.message : String(error2);
+  return sanitizeApiError(error2);
 }
 function requireJobDeps(res, deps2) {
   if (!deps2.projectRoot || !deps2.engine) {
@@ -9819,7 +9820,7 @@ async function handleTechStackRemediationApply(req, res, deps2) {
 }
 
 // src/server/http-server/api-handlers.ts
-import { sanitizeApiError } from "@wrongstack/core/security";
+import { sanitizeApiError as sanitizeApiError2 } from "@wrongstack/core/security";
 async function handleApiSessions(res, globalRoot) {
   if (!globalRoot) {
     res.writeHead(500, { "Content-Type": "application/json" });
@@ -9855,7 +9856,7 @@ async function handleApiSessions(res, globalRoot) {
     res.end(JSON.stringify(result));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 async function handleApiSessionAgents(res, globalRoot, sessionId) {
@@ -9892,7 +9893,7 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     );
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 function blocksToText(content) {
@@ -10056,7 +10057,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     );
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 function readJsonBody3(req) {
@@ -10130,7 +10131,7 @@ async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
     res.end(JSON.stringify({ ok: true, id: sent.id, to, type, delivered: entry.status }));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 async function handleApiSessionMailbox(res, globalRoot, sessionId) {
@@ -10183,7 +10184,7 @@ async function handleApiSessionMailbox(res, globalRoot, sessionId) {
     res.end(JSON.stringify({ sessionId, leader: leaderAddr, status: entry.status, thread }));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
@@ -10224,7 +10225,7 @@ async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
     res.end(JSON.stringify({ ok: true, id: sent.id, to, delivered: entry.status }));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 async function handleApiFleetBroadcast(res, req, globalRoot) {
@@ -10293,7 +10294,7 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
     res.end(JSON.stringify({ ok: true, delivered, targets: targets.length }));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 
@@ -10412,7 +10413,7 @@ function strictDecodeParam(segment, res) {
 
 // src/server/http-server/vector-memory-handlers.ts
 import { getSageSurface } from "@wrongstack/sage";
-import { sanitizeApiError as sanitizeApiError2 } from "@wrongstack/core/security";
+import { sanitizeApiError as sanitizeApiError3 } from "@wrongstack/core/security";
 function snapshotVectorMemory(store, opts = {}) {
   const stats = store.stats();
   return {
@@ -10453,7 +10454,7 @@ async function handleVectorMemoryStatus(res, getStore, opts = {}) {
     res.end(
       JSON.stringify({
         error: "Vector memory status failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10530,7 +10531,7 @@ async function handleVectorMemorySearch(res, url, getStore) {
     res.end(
       JSON.stringify({
         error: "Vector memory search failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10591,7 +10592,7 @@ async function handleVectorMemoryStore(res, req, getStore) {
     res.end(
       JSON.stringify({
         error: "Vector memory store failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10615,7 +10616,7 @@ async function handleVectorMemoryForget(res, url, getStore) {
     res.end(
       JSON.stringify({
         error: "Vector memory forget failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10695,7 +10696,7 @@ async function handleMemorySearch(res, url, getStore) {
     res.end(
       JSON.stringify({
         error: "Memory search failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -11039,7 +11040,7 @@ async function handleApiRoutes(req, res, url, deps2, requireAccessToken, accessT
       res.end(
         JSON.stringify({
           error: "TechStack store unavailable",
-          detail: sanitizeApiError3(error2)
+          detail: sanitizeApiError4(error2)
         })
       );
       return true;
@@ -15173,6 +15174,16 @@ function createModelOperations(context) {
 
 // src/server/open-browser.ts
 import { spawn } from "node:child_process";
+var URL_METACHAR_REGEX = /[&|;<>(){}^"'`%\n\r\0]/;
+function isSafeBrowserUrl(url) {
+  if (URL_METACHAR_REGEX.test(url)) return false;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 function browserOpenCommand(url, platform = process.platform) {
   if (platform === "win32") {
     return { command: "cmd", args: ["/c", "start", "", url] };
@@ -15183,6 +15194,16 @@ function browserOpenCommand(url, platform = process.platform) {
   return { command: "xdg-open", args: [url] };
 }
 function openBrowser(url, platform = process.platform) {
+  if (!isSafeBrowserUrl(url)) {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "open_browser.refused",
+        message: "Refusing to open a URL with an unexpected scheme or shell metacharacter"
+      })
+    );
+    return;
+  }
   try {
     const { command, args } = browserOpenCommand(url, platform);
     const child = spawn(command, args, { stdio: "ignore", detached: true, windowsHide: true });
@@ -24786,6 +24807,14 @@ function setupEvents(deps2) {
 // src/server/specs-ws-handler.ts
 import { computeTaskProgress } from "@wrongstack/core/tasking";
 import { SpecStore as SpecStore2, TaskGraphStore as TaskGraphStore2 } from "@wrongstack/sdd";
+var VALID_TASK_STATUSES = /* @__PURE__ */ new Set([
+  "pending",
+  "in_progress",
+  "blocked",
+  "failed",
+  "review",
+  "completed"
+]);
 var SpecsWebSocketHandler = class {
   specStore;
   graphStore;
@@ -24824,6 +24853,12 @@ var SpecsWebSocketHandler = class {
       }
       case "specs.taskStatus": {
         const { graphId, taskId, status } = msg.payload;
+        if (!VALID_TASK_STATUSES.has(status)) {
+          throw new Error(`Invalid task status: ${JSON.stringify(status)}`);
+        }
+        if (typeof graphId !== "string" || typeof taskId !== "string") {
+          throw new Error("specs.taskStatus requires string graphId and taskId");
+        }
         await this.updateTaskStatus(graphId, taskId, status);
         break;
       }
@@ -27983,6 +28018,7 @@ function createSessionStartPayload(g) {
     let inputCost = 0;
     let outputCost = 0;
     let cacheReadCost = 0;
+    let reasoningEffortLevels;
     try {
       const m = await resolveProviderModelMetadata(
         g.modelsRegistry,
@@ -27991,6 +28027,10 @@ function createSessionStartPayload(g) {
         config.providers?.[config.provider]
       );
       maxContext = m?.capabilities?.maxContext ?? 0;
+      const rc = m?.capabilities.reasoningConfig;
+      if (rc?.effortSupported && rc.effortLevels?.length) {
+        reasoningEffortLevels = rc.effortLevels;
+      }
       if (!maxContext) {
         try {
           const provider = await g.modelsRegistry.getProvider(config.provider);
@@ -28021,6 +28061,7 @@ function createSessionStartPayload(g) {
       contextMode: g.getContextMode(),
       ...protocolAdvertisement()
     };
+    if (reasoningEffortLevels) result.reasoningEffortLevels = reasoningEffortLevels;
     if (g.getNeedsSetup()) result.needsSetup = true;
     return result;
   };

package/dist/server/entry.js

@@ -8889,7 +8889,7 @@ function verifyClient(input) {
 
 // src/server/http-server/api-router.ts
 import * as v8 from "node:v8";
-import { sanitizeApiError as sanitizeApiError3 } from "@wrongstack/core/security";
+import { sanitizeApiError as sanitizeApiError4 } from "@wrongstack/core/security";
 import { getIndexState as getIndexState2 } from "@wrongstack/tools";
 
 // src/server/codemap-handlers.ts
@@ -9495,6 +9495,7 @@ async function handleRequirementIntakeArchive(res, service, intakeId) {
 
 // src/server/techstack-handlers.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
+import { sanitizeApiError } from "@wrongstack/core/security";
 var DEEP_DIVE_TIMEOUT_MS = 6e4;
 function sendJson3(res, status, data) {
   res.writeHead(status, { "Content-Type": "application/json" });
@@ -9524,7 +9525,7 @@ function handleTechStackSnapshot(res, deps2) {
   }
 }
 function errorMessage(error2) {
-  return error2 instanceof Error ? error2.message : String(error2);
+  return sanitizeApiError(error2);
 }
 function requireJobDeps(res, deps2) {
   if (!deps2.projectRoot || !deps2.engine) {
@@ -9725,7 +9726,7 @@ async function handleTechStackRemediationApply(req, res, deps2) {
 }
 
 // src/server/http-server/api-handlers.ts
-import { sanitizeApiError } from "@wrongstack/core/security";
+import { sanitizeApiError as sanitizeApiError2 } from "@wrongstack/core/security";
 async function handleApiSessions(res, globalRoot) {
   if (!globalRoot) {
     res.writeHead(500, { "Content-Type": "application/json" });
@@ -9761,7 +9762,7 @@ async function handleApiSessions(res, globalRoot) {
     res.end(JSON.stringify(result));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 async function handleApiSessionAgents(res, globalRoot, sessionId) {
@@ -9798,7 +9799,7 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     );
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 function blocksToText(content) {
@@ -9962,7 +9963,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     );
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 function readJsonBody3(req) {
@@ -10036,7 +10037,7 @@ async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
     res.end(JSON.stringify({ ok: true, id: sent.id, to, type, delivered: entry.status }));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 async function handleApiSessionMailbox(res, globalRoot, sessionId) {
@@ -10089,7 +10090,7 @@ async function handleApiSessionMailbox(res, globalRoot, sessionId) {
     res.end(JSON.stringify({ sessionId, leader: leaderAddr, status: entry.status, thread }));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
@@ -10130,7 +10131,7 @@ async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
     res.end(JSON.stringify({ ok: true, id: sent.id, to, delivered: entry.status }));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 async function handleApiFleetBroadcast(res, req, globalRoot) {
@@ -10199,7 +10200,7 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
     res.end(JSON.stringify({ ok: true, delivered, targets: targets.length }));
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+    res.end(JSON.stringify({ error: sanitizeApiError2(err) }));
   }
 }
 
@@ -10318,7 +10319,7 @@ function strictDecodeParam(segment, res) {
 
 // src/server/http-server/vector-memory-handlers.ts
 import { getSageSurface } from "@wrongstack/sage";
-import { sanitizeApiError as sanitizeApiError2 } from "@wrongstack/core/security";
+import { sanitizeApiError as sanitizeApiError3 } from "@wrongstack/core/security";
 function snapshotVectorMemory(store, opts = {}) {
   const stats = store.stats();
   return {
@@ -10359,7 +10360,7 @@ async function handleVectorMemoryStatus(res, getStore, opts = {}) {
     res.end(
       JSON.stringify({
         error: "Vector memory status failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10436,7 +10437,7 @@ async function handleVectorMemorySearch(res, url, getStore) {
     res.end(
       JSON.stringify({
         error: "Vector memory search failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10497,7 +10498,7 @@ async function handleVectorMemoryStore(res, req, getStore) {
     res.end(
       JSON.stringify({
         error: "Vector memory store failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10521,7 +10522,7 @@ async function handleVectorMemoryForget(res, url, getStore) {
     res.end(
       JSON.stringify({
         error: "Vector memory forget failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10601,7 +10602,7 @@ async function handleMemorySearch(res, url, getStore) {
     res.end(
       JSON.stringify({
         error: "Memory search failed",
-        detail: sanitizeApiError2(error2)
+        detail: sanitizeApiError3(error2)
       })
     );
   }
@@ -10945,7 +10946,7 @@ async function handleApiRoutes(req, res, url, deps2, requireAccessToken, accessT
       res.end(
         JSON.stringify({
           error: "TechStack store unavailable",
-          detail: sanitizeApiError3(error2)
+          detail: sanitizeApiError4(error2)
         })
       );
       return true;
@@ -22638,6 +22639,14 @@ function setupEvents(deps2) {
 // src/server/specs-ws-handler.ts
 import { computeTaskProgress } from "@wrongstack/core/tasking";
 import { SpecStore as SpecStore2, TaskGraphStore as TaskGraphStore2 } from "@wrongstack/sdd";
+var VALID_TASK_STATUSES = /* @__PURE__ */ new Set([
+  "pending",
+  "in_progress",
+  "blocked",
+  "failed",
+  "review",
+  "completed"
+]);
 var SpecsWebSocketHandler = class {
   specStore;
   graphStore;
@@ -22676,6 +22685,12 @@ var SpecsWebSocketHandler = class {
       }
       case "specs.taskStatus": {
         const { graphId, taskId, status } = msg.payload;
+        if (!VALID_TASK_STATUSES.has(status)) {
+          throw new Error(`Invalid task status: ${JSON.stringify(status)}`);
+        }
+        if (typeof graphId !== "string" || typeof taskId !== "string") {
+          throw new Error("specs.taskStatus requires string graphId and taskId");
+        }
         await this.updateTaskStatus(graphId, taskId, status);
         break;
       }
@@ -25835,6 +25850,7 @@ function createSessionStartPayload(g) {
     let inputCost = 0;
     let outputCost = 0;
     let cacheReadCost = 0;
+    let reasoningEffortLevels;
     try {
       const m = await resolveProviderModelMetadata(
         g.modelsRegistry,
@@ -25843,6 +25859,10 @@ function createSessionStartPayload(g) {
         config.providers?.[config.provider]
       );
       maxContext = m?.capabilities?.maxContext ?? 0;
+      const rc = m?.capabilities.reasoningConfig;
+      if (rc?.effortSupported && rc.effortLevels?.length) {
+        reasoningEffortLevels = rc.effortLevels;
+      }
       if (!maxContext) {
         try {
           const provider = await g.modelsRegistry.getProvider(config.provider);
@@ -25873,6 +25893,7 @@ function createSessionStartPayload(g) {
       contextMode: g.getContextMode(),
       ...protocolAdvertisement()
     };
+    if (reasoningEffortLevels) result.reasoningEffortLevels = reasoningEffortLevels;
     if (g.getNeedsSetup()) result.needsSetup = true;
     return result;
   };

package/dist/server/open-browser.d.ts

@@ -5,6 +5,15 @@
  * fire-and-forget: a missing opener, a headless box, or a spawn failure must
  * NEVER take the server down — the URL is always also printed to the console.
  */
+/**
+ * True when `url` is safe to hand to an OS opener.
+ *
+ * Scheme is checked as well as metacharacters: an opener will happily launch
+ * `file:`, `ms-msdt:` or a UNC path, and this function's callers include one
+ * (`github-copilot-oauth.ts`) whose URL comes from an HTTP response body rather
+ * than from our own code.
+ */
+export declare function isSafeBrowserUrl(url: string): boolean;
 /** Resolve the platform's URL-opener command + args. */
 export declare function browserOpenCommand(url: string, platform?: NodeJS.Platform): {
     command: string;

package/dist/server/server-runtime.d.ts

@@ -68,6 +68,7 @@ export declare function createSessionStartPayload(g: SessionStartPayloadGetters)
     protocolVersion: number;
     protocolCapabilities: string[];
     needsSetup?: boolean | undefined;
+    reasoningEffortLevels?: string[] | undefined;
 }>;
 interface WsServerResult {
     wssPrimary: WebSocketServer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/webui-server",
-  "version": "0.308.7",
+  "version": "0.309.1",
   "license": "MIT",
   "description": "WrongStack WebUI HTTP/WebSocket server module — extracted from @wrongstack/webui in PR #243/244 to remove the CLI -> @wrongstack/webui/server cross-package edge (audit §3.1.1). Pure backend: HTTP routes, WebSocket handlers, MCP tool wrappers, HTML serving. The web frontend lives in @wrongstack/webui; this package is the standalone server it can run on.",
   "keywords": [
@@ -40,17 +40,17 @@
   ],
   "dependencies": {
     "ws": "^8.21.3",
-    "@wrongstack/mcp": "0.308.7",
-    "@wrongstack/providers": "0.308.7",
-    "@wrongstack/core": "0.308.7",
-    "@wrongstack/kanban": "0.308.7",
-    "@wrongstack/requirement-intake": "0.308.7",
-    "@wrongstack/sage": "0.308.7",
-    "@wrongstack/sdd": "0.308.7",
-    "@wrongstack/runtime": "0.308.7",
-    "@wrongstack/tools": "0.308.7",
-    "@wrongstack/techstack": "0.308.7",
-    "@wrongstack/vector-memory": "0.308.7"
+    "@wrongstack/mcp": "0.309.1",
+    "@wrongstack/core": "0.309.1",
+    "@wrongstack/runtime": "0.309.1",
+    "@wrongstack/providers": "0.309.1",
+    "@wrongstack/requirement-intake": "0.309.1",
+    "@wrongstack/kanban": "0.309.1",
+    "@wrongstack/sage": "0.309.1",
+    "@wrongstack/sdd": "0.309.1",
+    "@wrongstack/vector-memory": "0.309.1",
+    "@wrongstack/tools": "0.309.1",
+    "@wrongstack/techstack": "0.309.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",