codebase-onboarder 0.6.0 → 1.0.0

package/server/router.js

@@ -9,156 +9,159 @@
 // `Sec-Fetch-Site` to stop another page and DNS rebinding from driving it.
 // Self-hosted mode adds real access-key authentication: local browser requests
 // stay open, remote browsers get a signed session, and API clients use Bearer.
-
 import { handleDocs } from './apiDocs.js';
 import { handleFile } from './apiFile.js';
 import { handleCleanup, handleScan } from './apiScan.js';
 import { sendError, sendJSON, readBody } from './http.js';
 import { crossOriginReason, rebindingReason } from './httpGuards.js';
 import { proxyChat } from './llmProxy.js';
+import { hermesWeb } from './hermesChat.js';
 import { serveStatic } from './static.js';
 import { handleSearch } from './apiSearch.js';
 import { handleBlame } from './apiGitBlame.js';
 import { handleDiff, handleDiffRefs } from './apiDiff.js';
+import { handleReview } from './apiReview.js';
 import { handleToolsInstall, handleToolsRun, handleToolsStatus } from './apiTools.js';
 import { handleMcpStart, handleMcpStatus, handleMcpStop, handleMcpCommand } from './apiMcp.js';
 import { handleGetSettings, handleRotateAccessKey, handleUpdateSettings } from './apiSettings.js';
 import { handleAuthStatus, handleLogin, handleLogout } from './apiAuth.js';
 import { accessKeysMatch, allowedHosts, authReason, bearerToken, DEFAULT_SETTINGS } from './config.js';
 import { hasValidSession } from './auth.js';
-
 const ROUTES = [
-  {
-    method: 'GET', path: '/api/diff/refs', sameOrigin: true,
-    run: ({ res, url }) => handleDiffRefs(res, url.searchParams.get('scan')),
-  },
-  {
-    method: 'GET', path: '/api/diff', sameOrigin: true,
-    run: ({ res, url }) => handleDiff(res, url.searchParams.get('scan'), url.searchParams),
-  },
-  {
-    method: 'POST', path: '/api/search', body: true,
-    run: ({ res, body }) => handleSearch(res, body),
-  },
-  {
-    method: 'GET', path: '/api/blame', sameOrigin: true,
-    run: ({ res, url }) => handleBlame(res, url.searchParams.get('scan'), url.searchParams.get('path')),
-  },
-  {
-    method: 'POST', path: '/api/scan', body: true,
-    run: ({ res, body, config }) => handleScan(res, body, config),
-  },
-  {
-    method: 'DELETE', prefix: '/api/scan/',
-    run: ({ res, rest }) => handleCleanup(res, decodeURIComponent(rest)),
-  },
-  {
-    method: 'GET', path: '/api/file', sameOrigin: true,
-    run: ({ res, url }) => handleFile(res, url.searchParams.get('scan'), url.searchParams.get('path')),
-  },
-  {
-    // The proxy is the handler; there is no wrapper to write. It forwards the
-    // browser's key to the endpoint the browser chose and never keeps either.
-    method: 'POST', path: '/api/explain', body: true,
-    run: ({ res, body }) => proxyChat(res, body),
-  },
-  {
-    method: 'POST', path: '/api/doc', body: true,
-    run: ({ res, body }) => handleDocs(res, body),
-  },
-  {
-    // Reports which analyzers are installed — environment information a foreign
-    // page has no business reading, so it is guarded like /api/file.
-    method: 'GET', path: '/api/tools', sameOrigin: true,
-    run: ({ res }) => handleToolsStatus(res),
-  },
-  {
-    // Runs real analyzers over a scanned root. `body: true` applies the size
-    // limit; the session check in the handler is the capability gate.
-    method: 'POST', path: '/api/tools/run', body: true,
-    run: ({ res, body }) => handleToolsRun(res, body),
-  },
-  {
-    // Installs a missing analyzer from the GUI. Same-origin like every POST;
-    // the tool name is validated against the registry and the install plans
-    // are fixed data, so the request body never reaches a command line.
-    method: 'POST', path: '/api/tools/install', body: true,
-    run: ({ res, body }) => handleToolsInstall(res, body),
-  },
-  {
-    // The MCP button's state, and the command an agent harness is configured with.
-    // The config is not secret, but it is a path into this machine and a foreign
-    // page has no business reading either one.
-    method: 'GET', path: '/api/mcp', sameOrigin: true,
-    run: ({ req, res, config }) => handleMcpStatus(req, res, config),
-  },
-  {
-    method: 'GET', path: '/api/mcp/command', sameOrigin: true,
-    run: ({ req, res, config }) => handleMcpCommand(req, res, config),
-  },
-  {
-    // Starting and stopping a process is a side effect on the person's machine, so
-    // these take a body like every other POST and are checked like every other POST.
-    method: 'POST', path: '/api/mcp/start', body: true,
-    run: ({ req, res, config }) => handleMcpStart(req, res, config),
-  },
-  {
-    method: 'POST', path: '/api/mcp/stop', body: true,
-    run: ({ req, res, config }) => handleMcpStop(req, res, config),
-  },
-  {
-    method: 'GET', path: '/api/health',
-    run: ({ res }) => sendJSON(res, 200, { ok: true }),
-  },
-  {
-    method: 'GET', path: '/api/auth/status', sameOrigin: true,
-    run: ({ req, res, settings }) => handleAuthStatus(req, res, settings),
-  },
-  {
-    method: 'POST', path: '/api/auth/login', body: true, sameOrigin: true,
-    run: ({ req, res, body, settings }) => handleLogin(req, res, body, settings),
-  },
-  {
-    method: 'POST', path: '/api/auth/logout', body: true, sameOrigin: true,
-    run: ({ req, res }) => handleLogout(req, res),
-  },
-  {
-    // The settings drawer and the CLI read the same public shape: everything
-    // about the configuration except the access key itself.
-    method: 'GET', path: '/api/settings', sameOrigin: true,
-    run: ({ req, res, config }) => handleGetSettings(req, res, config),
-  },
-  {
-    // PATCH semantics over a small allow-listed key set; the validation that
-    // rejects a bad port or a lawless mode lives in `server/config.js` and is
-    // shared with the CLI wizard, so both surfaces enforce one schema.
-    method: 'PUT', path: '/api/settings', body: true,
-    run: ({ res, body, config }) => handleUpdateSettings(res, body, config),
-  },
-  {
-    // The only way the key changes: generated on the server, shown once in
-    // this response, never readable again. In self-hosted mode this endpoint
-    // is itself behind the current key, so rotation requires possession.
-    method: 'POST', path: '/api/settings/access-key', body: true,
-    run: ({ req, res, config }) => handleRotateAccessKey(req, res, config),
-  },
+    { method: 'POST', path: '/api/review', body: true, run: ({ res, body }) => handleReview(res, body) },
+    {
+        method: 'GET', path: '/api/diff/refs', sameOrigin: true,
+        run: ({ res, url }) => handleDiffRefs(res, url.searchParams.get('scan')),
+    },
+    {
+        method: 'GET', path: '/api/diff', sameOrigin: true,
+        run: ({ res, url }) => handleDiff(res, url.searchParams.get('scan'), url.searchParams),
+    },
+    {
+        method: 'POST', path: '/api/search', body: true,
+        run: ({ res, body }) => handleSearch(res, body),
+    },
+    {
+        method: 'GET', path: '/api/blame', sameOrigin: true,
+        run: ({ res, url }) => handleBlame(res, url.searchParams.get('scan'), url.searchParams.get('path')),
+    },
+    {
+        method: 'POST', path: '/api/scan', body: true,
+        run: ({ res, body, config }) => handleScan(res, body, config),
+    },
+    {
+        method: 'DELETE', prefix: '/api/scan/',
+        run: ({ res, rest }) => handleCleanup(res, decodeURIComponent(rest)),
+    },
+    {
+        method: 'GET', path: '/api/file', sameOrigin: true,
+        run: ({ res, url }) => handleFile(res, url.searchParams.get('scan'), url.searchParams.get('path')),
+    },
+    {
+        // Hermes owns its server-side login. API mode forwards the browser's key
+        // to its chosen endpoint. Both share the same streaming response contract.
+        method: 'POST', path: '/api/explain', body: true,
+        run: ({ res, body, config }) => body?.connection === 'hermes'
+            ? (config.hermes || hermesWeb).chat(res, body) : proxyChat(res, body),
+    },
+    { method: 'GET', path: '/api/hermes', sameOrigin: true,
+        run: ({ res, config }) => (config.hermes || hermesWeb).status(res) },
+    {
+        method: 'POST', path: '/api/doc', body: true,
+        run: ({ res, body }) => handleDocs(res, body),
+    },
+    {
+        // Reports which analyzers are installed — environment information a foreign
+        // page has no business reading, so it is guarded like /api/file.
+        method: 'GET', path: '/api/tools', sameOrigin: true,
+        run: ({ res }) => handleToolsStatus(res),
+    },
+    {
+        // Runs real analyzers over a scanned root. `body: true` applies the size
+        // limit; the session check in the handler is the capability gate.
+        method: 'POST', path: '/api/tools/run', body: true,
+        run: ({ res, body }) => handleToolsRun(res, body),
+    },
+    {
+        // Installs a missing analyzer from the GUI. Same-origin like every POST;
+        // the tool name is validated against the registry and the install plans
+        // are fixed data, so the request body never reaches a command line.
+        method: 'POST', path: '/api/tools/install', body: true,
+        run: ({ res, body }) => handleToolsInstall(res, body),
+    },
+    {
+        // The MCP button's state, and the command an agent harness is configured with.
+        // The config is not secret, but it is a path into this machine and a foreign
+        // page has no business reading either one.
+        method: 'GET', path: '/api/mcp', sameOrigin: true,
+        run: ({ req, res, config }) => handleMcpStatus(req, res, config),
+    },
+    {
+        method: 'GET', path: '/api/mcp/command', sameOrigin: true,
+        run: ({ req, res, config }) => handleMcpCommand(req, res, config),
+    },
+    {
+        // Starting and stopping a process is a side effect on the person's machine, so
+        // these take a body like every other POST and are checked like every other POST.
+        method: 'POST', path: '/api/mcp/start', body: true,
+        run: ({ req, res, config }) => handleMcpStart(req, res, config),
+    },
+    {
+        method: 'POST', path: '/api/mcp/stop', body: true,
+        run: ({ req, res, config }) => handleMcpStop(req, res, config),
+    },
+    {
+        method: 'GET', path: '/api/health',
+        run: ({ res }) => sendJSON(res, 200, { ok: true }),
+    },
+    {
+        method: 'GET', path: '/api/auth/status', sameOrigin: true,
+        run: ({ req, res, settings }) => handleAuthStatus(req, res, settings),
+    },
+    {
+        method: 'POST', path: '/api/auth/login', body: true, sameOrigin: true,
+        run: ({ req, res, body, settings }) => handleLogin(req, res, body, settings),
+    },
+    {
+        method: 'POST', path: '/api/auth/logout', body: true, sameOrigin: true,
+        run: ({ req, res }) => handleLogout(req, res),
+    },
+    {
+        // The settings drawer and the CLI read the same public shape: everything
+        // about the configuration except the access key itself.
+        method: 'GET', path: '/api/settings', sameOrigin: true,
+        run: ({ req, res, config }) => handleGetSettings(req, res, config),
+    },
+    {
+        // PATCH semantics over a small allow-listed key set; the validation that
+        // rejects a bad port or a lawless mode lives in `server/config.js` and is
+        // shared with the CLI wizard, so both surfaces enforce one schema.
+        method: 'PUT', path: '/api/settings', body: true,
+        run: ({ res, body, config }) => handleUpdateSettings(res, body, config),
+    },
+    {
+        // The only way the key changes: generated on the server, shown once in
+        // this response, never readable again. In self-hosted mode this endpoint
+        // is itself behind the current key, so rotation requires possession.
+        method: 'POST', path: '/api/settings/access-key', body: true,
+        run: ({ req, res, config }) => handleRotateAccessKey(req, res, config),
+    },
 ];
-
 // The table itself, for the test that walks it. Exported read-only: the routes
 // are decided here, not assembled by whoever imports this.
 export const routes = Object.freeze(ROUTES.map((r) => Object.freeze({ ...r })));
-
 export function matchRoute(method, pathname) {
-  for (const route of ROUTES) {
-    if (route.method !== method) continue;
-    if (route.path === pathname) return { route, rest: '' };
-    if (route.prefix && pathname.startsWith(route.prefix)) {
-      return { route, rest: pathname.slice(route.prefix.length) };
+    for (const route of ROUTES) {
+        if (route.method !== method)
+            continue;
+        if (route.path === pathname)
+            return { route, rest: '' };
+        if (route.prefix && pathname.startsWith(route.prefix)) {
+            return { route, rest: pathname.slice(route.prefix.length) };
+        }
     }
-  }
-  return null;
+    return null;
 }
-
 // `config` carries the directories the handlers need — the project root to scan
 // for the demo, and the two roots static serving maps into. Passed in rather
 // than resolved here so a test can point the server somewhere else, and so this
@@ -169,79 +172,74 @@ export function matchRoute(method, pathname) {
 // request without a restart. A bare `createServer()` (the tests) has no getter
 // and sees the local-mode defaults — never somebody's home directory.
 async function liveSettings(config) {
-  if (typeof config?.getSettings !== 'function') return DEFAULT_SETTINGS;
-  try {
-    return await config.getSettings();
-  } catch {
-    return null; // unreadable config: fail closed, every /api call gets a 500
-  }
+    if (typeof config?.getSettings !== 'function')
+        return DEFAULT_SETTINGS;
+    try {
+        return await config.getSettings();
+    }
+    catch {
+        return null; // unreadable config: fail closed, every /api call gets a 500
+    }
 }
-
 export function createRouter(config) {
-  return async function handleRequest(req, res) {
-    try {
-      const url = new URL(req.url, 'http://127.0.0.1');
-
-      const settings = await liveSettings(config);
-      if (!settings) {
-        return sendError(res, 500, 'The settings file could not be read — run `onboarder doctor` to find out why.');
-      }
-
-      const wrongHost = rebindingReason(req, allowedHosts(settings));
-      if (wrongHost) {
-        const scope = settings.mode === 'self-hosted'
-          ? 'Onboarder only answers to its configured host and domain. '
-          : 'Onboarder only answers to localhost. ';
-        return sendError(res, 403, scope + wrongHost);
-      }
-
-      const found = matchRoute(req.method, url.pathname);
-      const publicAuthRoute = ['/api/health', '/api/auth/status', '/api/auth/login', '/api/auth/logout'].includes(url.pathname);
-      if (req.method !== 'GET' || found?.route.sameOrigin) {
-        const foreign = crossOriginReason(req);
-        if (foreign) {
-          return sendError(res, 403, 'That request did not come from Onboarder’s own page. ' + foreign);
+    return async function handleRequest(req, res) {
+        try {
+            const url = new URL(req.url, 'http://127.0.0.1');
+            const settings = await liveSettings(config);
+            if (!settings) {
+                return sendError(res, 500, 'The settings file could not be read — run `onboarder doctor` to find out why.');
+            }
+            const wrongHost = rebindingReason(req, allowedHosts(settings));
+            if (wrongHost) {
+                const scope = settings.mode === 'self-hosted'
+                    ? 'Onboarder only answers to its configured host and domain. '
+                    : 'Onboarder only answers to localhost. ';
+                return sendError(res, 403, scope + wrongHost);
+            }
+            const found = matchRoute(req.method, url.pathname);
+            const publicAuthRoute = ['/api/health', '/api/auth/status', '/api/auth/login', '/api/auth/logout'].includes(url.pathname);
+            if (req.method !== 'GET' || found?.route.sameOrigin) {
+                const foreign = crossOriginReason(req);
+                if (foreign) {
+                    return sendError(res, 403, 'That request did not come from Onboarder’s own page. ' + foreign);
+                }
+            }
+            // Bearer clients keep their existing API contract. A browser gets a signed,
+            // HttpOnly session from the login form instead of storing the raw key.
+            const bearerClient = accessKeysMatch(settings.accessKey, bearerToken(req));
+            const browserAuthenticated = hasValidSession(req, settings);
+            const authDenied = authReason(req, settings);
+            const locallyExempt = !authDenied;
+            const authenticated = bearerClient || browserAuthenticated || locallyExempt;
+            const remoteSelfHosted = settings.mode === 'self-hosted' && Boolean(authDenied);
+            if (remoteSelfHosted && !authenticated && !publicAuthRoute) {
+                // API callers keep a machine-readable 401. A browser navigation gets the
+                // themed sign-in document so the user never has to paste JSON into a tab.
+                const accepts = String(req.headers?.accept || '');
+                if (req.method === 'GET' && (url.pathname === '/' || accepts.includes('text/html'))) {
+                    res.statusCode = 200;
+                    return await serveStatic(res, '/login.html', config);
+                }
+                return sendError(res, 401, authDenied || 'Sign in with the Onboarder access key first.');
+            }
+            if (url.pathname === '/api/auth/logout') {
+                // Always clear the browser cookie, even if it had already expired.
+                return handleLogout(req, res);
+            }
+            if (found) {
+                const body = found.route.body ? await readBody(req) : null;
+                return await found.route.run({ req, res, url, body, rest: found.rest, config, settings });
+            }
+            if (req.method === 'GET')
+                return await serveStatic(res, url.pathname, config);
+            sendError(res, 404, 'Nothing lives at ' + url.pathname + '.');
         }
-      }
-
-      // Bearer clients keep their existing API contract. A browser gets a signed,
-      // HttpOnly session from the login form instead of storing the raw key.
-      const bearerClient = accessKeysMatch(settings.accessKey, bearerToken(req));
-      const browserAuthenticated = hasValidSession(req, settings);
-      const authDenied = authReason(req, settings);
-      const locallyExempt = !authDenied;
-      const authenticated = bearerClient || browserAuthenticated || locallyExempt;
-      const remoteSelfHosted = settings.mode === 'self-hosted' && Boolean(authDenied);
-
-      if (remoteSelfHosted && !authenticated && !publicAuthRoute) {
-        // API callers keep a machine-readable 401. A browser navigation gets the
-        // themed sign-in document so the user never has to paste JSON into a tab.
-        const accepts = String(req.headers?.accept || '');
-        if (req.method === 'GET' && (url.pathname === '/' || accepts.includes('text/html'))) {
-          res.statusCode = 200;
-          return await serveStatic(res, '/login.html', config);
+        catch (err) {
+            // The last resort. Handlers turn their own expected failures into a status
+            // that says something useful; anything reaching here is a bug or a broken
+            // request body, and the message is more use to the person than "500".
+            sendError(res, 500, err.message || 'Something went sideways.');
         }
-        return sendError(res, 401, authDenied || 'Sign in with the Onboarder access key first.');
-      }
-
-      if (url.pathname === '/api/auth/logout') {
-        // Always clear the browser cookie, even if it had already expired.
-        return handleLogout(req, res);
-      }
-
-      if (found) {
-        const body = found.route.body ? await readBody(req) : null;
-        return await found.route.run({ req, res, url, body, rest: found.rest, config, settings });
-      }
-
-      if (req.method === 'GET') return await serveStatic(res, url.pathname, config);
-
-      sendError(res, 404, 'Nothing lives at ' + url.pathname + '.');
-    } catch (err) {
-      // The last resort. Handlers turn their own expected failures into a status
-      // that says something useful; anything reaching here is a bug or a broken
-      // request body, and the message is more use to the person than "500".
-      sendError(res, 500, err.message || 'Something went sideways.');
-    }
-  };
+    };
 }
+//# sourceMappingURL=router.js.map

package/server/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/server/router.ts"],"names":[],"mappings":"AAKA,gDAAgD;AAChD,EAAE;AACF,gFAAgF;AAChF,kFAAkF;AAClF,8EAA8E;AAC9E,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,MAAM,GAAY;IACtB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;IACpG;QACE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI;QACvD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;KACzE;IACD;QACE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI;QAClD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC;KACvF;IACD;QACE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI;QAC/C,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC;KAChD;IACD;QACE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI;QACnD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;KACpG;IACD;QACE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI;QAC7C,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;KAC9D;IACD;QACE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY;QACtC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;KACrE;IACD;QACE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI;QAClD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;KACnG;IACD;QACE,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI;QAChD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,QAAQ;YAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC;KACxE;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI;QACpD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;IACtE;QACE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI;QAC5C,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC;KAC9C;IACD;QACE,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI;QACnD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC;KACzC;IACD;QACE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI;QAClD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC;KAClD;IACD;QACE,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI;QACtD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC;KACtD;IACD;QACE,+EAA+E;QAC/E,6EAA6E;QAC7E,2CAA2C;QAC3C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI;QACjD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;KACjE;IACD;QACE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI;QACzD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;KAClE;IACD;QACE,+EAA+E;QAC/E,iFAAiF;QACjF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI;QAClD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;KAChE;IACD;QACE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI;QACjD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;KAC/D;IACD;QACE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa;QAClC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KACnD;IACD;QACE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI;QACzD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC;KACtE;IACD;QACE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;QACrE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC;KAC7E;IACD;QACE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;QACtE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;KAC9C;IACD;QACE,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI;QACtD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;KACnE;IACD;QACE,yEAAyE;QACzE,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI;QAChD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;KACxE;IACD;QACE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,IAAI;QAC5D,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC;KACvE;CACF,CAAC;AAEF,+EAA+E;AAC/E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,UAAU,UAAU,CAAC,MAAM,EAAE,QAAQ;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;YAAE,SAAS;QACtC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,0DAA0D;AAC1D,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,sEAAsE;AACtE,KAAK,UAAU,YAAY,CAAC,MAAM;IAChC,IAAI,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU;QAAE,OAAO,gBAAgB,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6DAA6D;IAC5E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAM;IACjC,OAAO,KAAK,UAAU,aAAa,CAAC,GAAG,EAAE,GAAG;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAEjD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,+EAA+E,CAAC,CAAC;YAC9G,CAAC;YAED,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,KAAK,aAAa;oBAC3C,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,uCAAuC,CAAC;gBAC5C,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1H,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,uDAAuD,GAAG,OAAO,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,uEAAuE;YACvE,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3E,MAAM,oBAAoB,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7C,MAAM,aAAa,GAAG,CAAC,UAAU,CAAC;YAClC,MAAM,aAAa,GAAG,YAAY,IAAI,oBAAoB,IAAI,aAAa,CAAC;YAC5E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;YAEhF,IAAI,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC3D,yEAAyE;gBACzE,0EAA0E;gBAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBAClD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;oBACpF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;gBACvD,CAAC;gBACD,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,IAAI,8CAA8C,CAAC,CAAC;YAC3F,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBACxC,mEAAmE;gBACnE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3D,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5F,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAE9E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,0EAA0E;YAC1E,sEAAsE;YACtE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http';\nimport type { Settings } from '../shared/contracts.js';\n\ninterface RouteContext { req: IncomingMessage; res: ServerResponse; url: URL; body: any; rest: string; config: any; settings: Settings }\ninterface Route { method: string; path?: string; prefix?: string; body?: boolean; sameOrigin?: boolean; run(context: RouteContext): unknown }\n// The route table and the gates in front of it.\n//\n// Everything arrives here: one function decides whether a request is allowed to\n// be answered at all, then which handler answers it. The routes are a list rather\n// than a ladder of `if` statements so that the whole surface of the server is\n// visible in one screen, and everything else is a static file.\n//\n// There are three concerns. Local mode relies on `Host`, `Origin`, and\n// `Sec-Fetch-Site` to stop another page and DNS rebinding from driving it.\n// Self-hosted mode adds real access-key authentication: local browser requests\n// stay open, remote browsers get a signed session, and API clients use Bearer.\n\nimport { handleDocs } from './apiDocs.js';\nimport { handleFile } from './apiFile.js';\nimport { handleCleanup, handleScan } from './apiScan.js';\nimport { sendError, sendJSON, readBody } from './http.js';\nimport { crossOriginReason, rebindingReason } from './httpGuards.js';\nimport { proxyChat } from './llmProxy.js';\nimport { hermesWeb } from './hermesChat.js';\nimport { serveStatic } from './static.js';\nimport { handleSearch } from './apiSearch.js';\nimport { handleBlame } from './apiGitBlame.js';\nimport { handleDiff, handleDiffRefs } from './apiDiff.js';\nimport { handleReview } from './apiReview.js';\nimport { handleToolsInstall, handleToolsRun, handleToolsStatus } from './apiTools.js';\nimport { handleMcpStart, handleMcpStatus, handleMcpStop, handleMcpCommand } from './apiMcp.js';\nimport { handleGetSettings, handleRotateAccessKey, handleUpdateSettings } from './apiSettings.js';\nimport { handleAuthStatus, handleLogin, handleLogout } from './apiAuth.js';\nimport { accessKeysMatch, allowedHosts, authReason, bearerToken, DEFAULT_SETTINGS } from './config.js';\nimport { hasValidSession } from './auth.js';\n\nconst ROUTES: Route[] = [\n  { method: 'POST', path: '/api/review', body: true, run: ({ res, body }) => handleReview(res, body) },\n  {\n    method: 'GET', path: '/api/diff/refs', sameOrigin: true,\n    run: ({ res, url }) => handleDiffRefs(res, url.searchParams.get('scan')),\n  },\n  {\n    method: 'GET', path: '/api/diff', sameOrigin: true,\n    run: ({ res, url }) => handleDiff(res, url.searchParams.get('scan'), url.searchParams),\n  },\n  {\n    method: 'POST', path: '/api/search', body: true,\n    run: ({ res, body }) => handleSearch(res, body),\n  },\n  {\n    method: 'GET', path: '/api/blame', sameOrigin: true,\n    run: ({ res, url }) => handleBlame(res, url.searchParams.get('scan'), url.searchParams.get('path')),\n  },\n  {\n    method: 'POST', path: '/api/scan', body: true,\n    run: ({ res, body, config }) => handleScan(res, body, config),\n  },\n  {\n    method: 'DELETE', prefix: '/api/scan/',\n    run: ({ res, rest }) => handleCleanup(res, decodeURIComponent(rest)),\n  },\n  {\n    method: 'GET', path: '/api/file', sameOrigin: true,\n    run: ({ res, url }) => handleFile(res, url.searchParams.get('scan'), url.searchParams.get('path')),\n  },\n  {\n    // Hermes owns its server-side login. API mode forwards the browser's key\n    // to its chosen endpoint. Both share the same streaming response contract.\n    method: 'POST', path: '/api/explain', body: true,\n    run: ({ res, body, config }) => body?.connection === 'hermes'\n      ? (config.hermes || hermesWeb).chat(res, body) : proxyChat(res, body),\n  },\n  { method: 'GET', path: '/api/hermes', sameOrigin: true,\n    run: ({ res, config }) => (config.hermes || hermesWeb).status(res) },\n  {\n    method: 'POST', path: '/api/doc', body: true,\n    run: ({ res, body }) => handleDocs(res, body),\n  },\n  {\n    // Reports which analyzers are installed — environment information a foreign\n    // page has no business reading, so it is guarded like /api/file.\n    method: 'GET', path: '/api/tools', sameOrigin: true,\n    run: ({ res }) => handleToolsStatus(res),\n  },\n  {\n    // Runs real analyzers over a scanned root. `body: true` applies the size\n    // limit; the session check in the handler is the capability gate.\n    method: 'POST', path: '/api/tools/run', body: true,\n    run: ({ res, body }) => handleToolsRun(res, body),\n  },\n  {\n    // Installs a missing analyzer from the GUI. Same-origin like every POST;\n    // the tool name is validated against the registry and the install plans\n    // are fixed data, so the request body never reaches a command line.\n    method: 'POST', path: '/api/tools/install', body: true,\n    run: ({ res, body }) => handleToolsInstall(res, body),\n  },\n  {\n    // The MCP button's state, and the command an agent harness is configured with.\n    // The config is not secret, but it is a path into this machine and a foreign\n    // page has no business reading either one.\n    method: 'GET', path: '/api/mcp', sameOrigin: true,\n    run: ({ req, res, config }) => handleMcpStatus(req, res, config),\n  },\n  {\n    method: 'GET', path: '/api/mcp/command', sameOrigin: true,\n    run: ({ req, res, config }) => handleMcpCommand(req, res, config),\n  },\n  {\n    // Starting and stopping a process is a side effect on the person's machine, so\n    // these take a body like every other POST and are checked like every other POST.\n    method: 'POST', path: '/api/mcp/start', body: true,\n    run: ({ req, res, config }) => handleMcpStart(req, res, config),\n  },\n  {\n    method: 'POST', path: '/api/mcp/stop', body: true,\n    run: ({ req, res, config }) => handleMcpStop(req, res, config),\n  },\n  {\n    method: 'GET', path: '/api/health',\n    run: ({ res }) => sendJSON(res, 200, { ok: true }),\n  },\n  {\n    method: 'GET', path: '/api/auth/status', sameOrigin: true,\n    run: ({ req, res, settings }) => handleAuthStatus(req, res, settings),\n  },\n  {\n    method: 'POST', path: '/api/auth/login', body: true, sameOrigin: true,\n    run: ({ req, res, body, settings }) => handleLogin(req, res, body, settings),\n  },\n  {\n    method: 'POST', path: '/api/auth/logout', body: true, sameOrigin: true,\n    run: ({ req, res }) => handleLogout(req, res),\n  },\n  {\n    // The settings drawer and the CLI read the same public shape: everything\n    // about the configuration except the access key itself.\n    method: 'GET', path: '/api/settings', sameOrigin: true,\n    run: ({ req, res, config }) => handleGetSettings(req, res, config),\n  },\n  {\n    // PATCH semantics over a small allow-listed key set; the validation that\n    // rejects a bad port or a lawless mode lives in `server/config.js` and is\n    // shared with the CLI wizard, so both surfaces enforce one schema.\n    method: 'PUT', path: '/api/settings', body: true,\n    run: ({ res, body, config }) => handleUpdateSettings(res, body, config),\n  },\n  {\n    // The only way the key changes: generated on the server, shown once in\n    // this response, never readable again. In self-hosted mode this endpoint\n    // is itself behind the current key, so rotation requires possession.\n    method: 'POST', path: '/api/settings/access-key', body: true,\n    run: ({ req, res, config }) => handleRotateAccessKey(req, res, config),\n  },\n];\n\n// The table itself, for the test that walks it. Exported read-only: the routes\n// are decided here, not assembled by whoever imports this.\nexport const routes = Object.freeze(ROUTES.map((r) => Object.freeze({ ...r })));\n\nexport function matchRoute(method, pathname) {\n  for (const route of ROUTES) {\n    if (route.method !== method) continue;\n    if (route.path === pathname) return { route, rest: '' };\n    if (route.prefix && pathname.startsWith(route.prefix)) {\n      return { route, rest: pathname.slice(route.prefix.length) };\n    }\n  }\n  return null;\n}\n\n// `config` carries the directories the handlers need — the project root to scan\n// for the demo, and the two roots static serving maps into. Passed in rather\n// than resolved here so a test can point the server somewhere else, and so this\n// module has nothing to say about where it was installed.\n//\n// Settings arrive the same way: `config.getSettings` is read on every request,\n// so a key rotated or a domain changed through the API takes effect on the next\n// request without a restart. A bare `createServer()` (the tests) has no getter\n// and sees the local-mode defaults — never somebody's home directory.\nasync function liveSettings(config) {\n  if (typeof config?.getSettings !== 'function') return DEFAULT_SETTINGS;\n  try {\n    return await config.getSettings();\n  } catch {\n    return null; // unreadable config: fail closed, every /api call gets a 500\n  }\n}\n\nexport function createRouter(config) {\n  return async function handleRequest(req, res) {\n    try {\n      const url = new URL(req.url, 'http://127.0.0.1');\n\n      const settings = await liveSettings(config);\n      if (!settings) {\n        return sendError(res, 500, 'The settings file could not be read — run `onboarder doctor` to find out why.');\n      }\n\n      const wrongHost = rebindingReason(req, allowedHosts(settings));\n      if (wrongHost) {\n        const scope = settings.mode === 'self-hosted'\n          ? 'Onboarder only answers to its configured host and domain. '\n          : 'Onboarder only answers to localhost. ';\n        return sendError(res, 403, scope + wrongHost);\n      }\n\n      const found = matchRoute(req.method, url.pathname);\n      const publicAuthRoute = ['/api/health', '/api/auth/status', '/api/auth/login', '/api/auth/logout'].includes(url.pathname);\n      if (req.method !== 'GET' || found?.route.sameOrigin) {\n        const foreign = crossOriginReason(req);\n        if (foreign) {\n          return sendError(res, 403, 'That request did not come from Onboarder’s own page. ' + foreign);\n        }\n      }\n\n      // Bearer clients keep their existing API contract. A browser gets a signed,\n      // HttpOnly session from the login form instead of storing the raw key.\n      const bearerClient = accessKeysMatch(settings.accessKey, bearerToken(req));\n      const browserAuthenticated = hasValidSession(req, settings);\n      const authDenied = authReason(req, settings);\n      const locallyExempt = !authDenied;\n      const authenticated = bearerClient || browserAuthenticated || locallyExempt;\n      const remoteSelfHosted = settings.mode === 'self-hosted' && Boolean(authDenied);\n\n      if (remoteSelfHosted && !authenticated && !publicAuthRoute) {\n        // API callers keep a machine-readable 401. A browser navigation gets the\n        // themed sign-in document so the user never has to paste JSON into a tab.\n        const accepts = String(req.headers?.accept || '');\n        if (req.method === 'GET' && (url.pathname === '/' || accepts.includes('text/html'))) {\n          res.statusCode = 200;\n          return await serveStatic(res, '/login.html', config);\n        }\n        return sendError(res, 401, authDenied || 'Sign in with the Onboarder access key first.');\n      }\n\n      if (url.pathname === '/api/auth/logout') {\n        // Always clear the browser cookie, even if it had already expired.\n        return handleLogout(req, res);\n      }\n\n      if (found) {\n        const body = found.route.body ? await readBody(req) : null;\n        return await found.route.run({ req, res, url, body, rest: found.rest, config, settings });\n      }\n\n      if (req.method === 'GET') return await serveStatic(res, url.pathname, config);\n\n      sendError(res, 404, 'Nothing lives at ' + url.pathname + '.');\n    } catch (err) {\n      // The last resort. Handlers turn their own expected failures into a status\n      // that says something useful; anything reaching here is a bug or a broken\n      // request body, and the message is more use to the person than \"500\".\n      sendError(res, 500, err.message || 'Something went sideways.');\n    }\n  };\n}\n"]}

package/server/scanRequest.d.ts

@@ -0,0 +1,3 @@
+import type { ScanRequest } from '../shared/contracts.js';
+/** Validate untrusted JSON before touching the filesystem or cloning anything. */
+export declare function parseScanRequest(value: unknown): ScanRequest;

package/server/scanRequest.js

@@ -0,0 +1,36 @@
+import { normalizeScanOptions } from '../shared/analyzer/scanControl.js';
+/** Validate untrusted JSON before touching the filesystem or cloning anything. */
+export function parseScanRequest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new TypeError('Send a path, a gitUrl, or { demo: true }.');
+    }
+    const body = value;
+    const sources = [body.path !== undefined, body.gitUrl !== undefined, body.demo === true].filter(Boolean).length;
+    if (sources === 0)
+        throw new TypeError('Send a path, a gitUrl, or { demo: true }.');
+    if (sources !== 1)
+        throw new TypeError('Send exactly one path, gitUrl, or { demo: true }.');
+    const options = {};
+    if (body.options !== undefined) {
+        if (!body.options || typeof body.options !== 'object' || Array.isArray(body.options)) {
+            throw new TypeError('Scan options must be an object.');
+        }
+        const input = body.options;
+        for (const key of ['maxFiles', 'maxFileSize', 'readConcurrency']) {
+            if (input[key] === undefined)
+                continue;
+            if (typeof input[key] !== 'number')
+                throw new TypeError(`${key} must be a number.`);
+            options[key] = input[key];
+        }
+        normalizeScanOptions(options);
+    }
+    if (body.demo === true)
+        return { demo: true, options };
+    if (typeof body.path === 'string' && body.path.trim())
+        return { path: body.path.trim(), options };
+    if (typeof body.gitUrl === 'string' && body.gitUrl.trim())
+        return { gitUrl: body.gitUrl.trim(), options };
+    throw new TypeError('The path or gitUrl must be a non-empty string.');
+}
+//# sourceMappingURL=scanRequest.js.map

package/server/scanRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanRequest.js","sourceRoot":"","sources":["../src/server/scanRequest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAChH,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACpF,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAkC,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,iBAAiB,CAAU,EAAE,CAAC;YAC1E,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;IAC1G,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;AACxE,CAAC","sourcesContent":["import type { ScanRequest, ScanRequestOptions } from '../shared/contracts.js';\nimport { normalizeScanOptions } from '../shared/analyzer/scanControl.js';\n\n/** Validate untrusted JSON before touching the filesystem or cloning anything. */\nexport function parseScanRequest(value: unknown): ScanRequest {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new TypeError('Send a path, a gitUrl, or { demo: true }.');\n  }\n  const body = value as Record<string, unknown>;\n  const sources = [body.path !== undefined, body.gitUrl !== undefined, body.demo === true].filter(Boolean).length;\n  if (sources === 0) throw new TypeError('Send a path, a gitUrl, or { demo: true }.');\n  if (sources !== 1) throw new TypeError('Send exactly one path, gitUrl, or { demo: true }.');\n  const options: ScanRequestOptions = {};\n  if (body.options !== undefined) {\n    if (!body.options || typeof body.options !== 'object' || Array.isArray(body.options)) {\n      throw new TypeError('Scan options must be an object.');\n    }\n    const input = body.options as Record<string, unknown>;\n    for (const key of ['maxFiles', 'maxFileSize', 'readConcurrency'] as const) {\n      if (input[key] === undefined) continue;\n      if (typeof input[key] !== 'number') throw new TypeError(`${key} must be a number.`);\n      options[key] = input[key];\n    }\n    normalizeScanOptions(options);\n  }\n  if (body.demo === true) return { demo: true, options };\n  if (typeof body.path === 'string' && body.path.trim()) return { path: body.path.trim(), options };\n  if (typeof body.gitUrl === 'string' && body.gitUrl.trim()) return { gitUrl: body.gitUrl.trim(), options };\n  throw new TypeError('The path or gitUrl must be a non-empty string.');\n}\n"]}

package/server/searchIndex.d.ts

@@ -0,0 +1,17 @@
+export declare function buildSearchIndex(source: any, codeFiles: any, options?: Record<string, any>): Promise<{
+    index: Map<any, any>;
+    docCounts: Map<any, any>;
+    totalDocs: number;
+    totalBytes: number;
+    skipped: {
+        tooLarge: number;
+        overCap: number;
+        readFailed: number;
+        binary: number;
+        noTokens: number;
+    };
+    cap: {
+        maxFileBytes: number;
+        maxTotalBytes: number;
+    };
+}>;