driggsby 0.7.0 → 0.7.2

package/README.md

@@ -123,4 +123,6 @@ signed in with an earlier version of the CLI, run
 
 ## License
 
-Apache-2.0
+Apache-2.0. The bundled Inter font (`assets/Inter.woff2`), which
+`driggsby dev` serves to the app it previews, is under the SIL Open Font
+License 1.1; see `assets/Inter-LICENSE.txt`.

package/assets/Inter-LICENSE.txt

@@ -0,0 +1,92 @@
+Copyright (c) 2016 The Inter Project Authors (https://github.com/rsms/inter)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION AND CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/dist/dev/app-policy.js

@@ -0,0 +1,78 @@
+// The security headers on every app-origin response, the service worker
+// the app origin hands out, and the policy the host page requires of its
+// frame: a copy of what Driggsby's serving host and console do for a
+// deployed app, so the preview refuses what a deployed app is refused and a
+// page that works here works once deployed. The Driggsby service is
+// canonical: change it there first, then mirror it here.
+//
+// The content security policy keeps the page's loads on its own origin
+// (another site's script, font, image, or fetch is refused), refuses frames,
+// objects, forms, and eval, and sandboxes the page as the serving host does.
+// frame-ancestors names the host page, the only page that may frame the
+// app. A file that can run script (a page, an SVG, JavaScript) also carries
+// Connection-Allowlist, which has Chrome refuse any connection the page
+// starts to anywhere else, WebRTC included. Any other file gets neither the
+// list nor script: its sandbox grants nothing, so it opens in an origin of
+// its own, as it does deployed. Never widen the list to other files; the
+// serving host sends it only where script can run.
+const SCRIPT_MEDIA_TYPES = new Set([
+    "text/html",
+    "image/svg+xml",
+    "text/javascript",
+    "application/javascript",
+]);
+const POLICY_DIRECTIVES = [
+    "default-src 'self'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "connect-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'",
+];
+// What the host page requires of every document its frame shows (the
+// iframe's csp attribute), as the console does: it binds even a document
+// that doesn't come from this server.
+export const FRAME_POLICY = POLICY_DIRECTIVES.join("; ");
+// The only service worker either preview origin hands out, verbatim from
+// the serving host. An app's own worker could answer the frame's
+// navigations with documents it builds, carrying none of these headers, and
+// on these fixed ports it would outlive the preview and answer the next
+// app's too; a worker some other local server once left on the host port
+// would answer the host page, which runs tools. This one listens for
+// nothing.
+export const INERT_SERVICE_WORKER = `// This origin's only service worker. It listens for nothing, so it answers
+// no request: every page and file comes from the network with the host's
+// own headers. It behaves like any default worker: it waits until no page
+// is using the worker before it, then takes over.
+`;
+// hostOrigin is empty until the host server has bound (a startup race
+// measured in milliseconds); until then nothing may frame the app.
+export function appResponseHeaders(hostOrigin, contentType) {
+    const mediaType = (contentType.split(";")[0] ?? "").trim().toLowerCase();
+    const runsScript = SCRIPT_MEDIA_TYPES.has(mediaType);
+    const directives = [
+        runsScript ? "sandbox allow-scripts allow-same-origin" : "sandbox",
+        ...POLICY_DIRECTIVES,
+        `frame-ancestors ${hostOrigin === "" ? "'none'" : hostOrigin}`,
+    ];
+    const headers = {
+        "Content-Security-Policy": directives.join("; "),
+        // The served content types are final; the browser never guesses.
+        "X-Content-Type-Options": "nosniff",
+        "Referrer-Policy": "no-referrer",
+        "Cross-Origin-Resource-Policy": "same-origin",
+        "Cross-Origin-Opener-Policy": "same-origin",
+        "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=()",
+    };
+    if (hostOrigin !== "") {
+        headers["Allow-CSP-From"] = hostOrigin;
+    }
+    if (runsScript) {
+        headers["Connection-Allowlist"] = "(response-origin)";
+    }
+    return headers;
+}

package/dist/dev/dashboard-font.js

@@ -0,0 +1,14 @@
+// Inter, the face Driggsby apps set their text in. Driggsby serves it on
+// every deployed app's own origin at DASHBOARD_FONT_PATH, and the scaffold
+// loads it from there; dev serves the same bytes at the same path, from
+// this package (assets/Inter.woff2, under the SIL Open Font License 1.1 in
+// assets/Inter-LICENSE.txt). So the preview draws the letters the deployed
+// page draws, and nothing reaches the internet for them.
+import { readFile } from "node:fs/promises";
+export const DASHBOARD_FONT_PATH = "/-/inter.woff2";
+export const DASHBOARD_FONT_TYPE = "font/woff2";
+// src/dev/ and dist/dev/ both sit two levels under the package root.
+const FONT_FILE = new URL("../../assets/Inter.woff2", import.meta.url);
+export async function loadDashboardFont() {
+    return await readFile(FONT_FILE);
+}

package/dist/dev/dev-command.js

@@ -13,6 +13,7 @@ import { defaultCredentialEnvironment, } from "../credentials/store.js";
 import { requireDeploySession } from "../deploy/api-session.js";
 import { tryOpenUrl } from "../login/open-url.js";
 import { wrapProse } from "../terminal-text.js";
+import { loadDashboardFont } from "./dashboard-font.js";
 import { DEV_IDLE_MINUTES, DEV_START_COMMAND, DEV_STOP_COMMAND } from "./dev-commands.js";
 import { startDevServers } from "./dev-servers.js";
 import { pruneDevStatesForPorts, readDevStates, removeDevState, writeDevState } from "./dev-state.js";
@@ -63,6 +64,7 @@ export async function runDev(options = {}, environment = defaultCredentialEnviro
     const session = await requireDeploySession(environment);
     await refuseSecondPreview(environment.homeDirectory, projectDirectory);
     const sdkBundle = await loadSdkBundle();
+    const dashboardFont = await loadDashboardFont();
     // Retries like the production host, so the preview loads the way the
     // deployed app would.
     const broker = new McpBroker({ baseUrl: session.baseUrl, token: session.token, retries: true });
@@ -83,6 +85,7 @@ export async function runDev(options = {}, environment = defaultCredentialEnviro
                 background: config.background,
                 serveDirectory: config.serveDirectory,
                 sdkBundle,
+                dashboardFont,
                 runToolCall: async (tool, argumentsObject) => {
                     const started = Date.now();
                     const calledIn = documentGeneration;

package/dist/dev/dev-servers.js

@@ -1,10 +1,12 @@
 // The two local servers behind `driggsby dev`, mirroring production's
 // topology: the host origin (the page a person opens; serves the host page
 // and the CLI's tool-call endpoint) and the app origin (the app's own
-// files, plus the Driggsby SDK at /-/driggsby-sdk.js). Both bind loopback
-// only. The app token never appears here — the broker callback holds it in
-// the CLI process.
+// files, plus the Driggsby SDK at /-/driggsby-sdk.js and the dashboard font
+// at /-/inter.woff2). Both bind loopback only. The app token never appears
+// here — the broker callback holds it in the CLI process.
 import { createServer } from "node:http";
+import { appResponseHeaders, INERT_SERVICE_WORKER } from "./app-policy.js";
+import { DASHBOARD_FONT_PATH, DASHBOARD_FONT_TYPE } from "./dashboard-font.js";
 import { DEV_IDENTITY_PATH } from "./dev-state.js";
 import { hostPageHtml, HOST_PAGE_JS } from "./host-page.js";
 import { serveStaticFile } from "./static-files.js";
@@ -15,13 +17,16 @@ import { APP_TOOL_ALLOWLIST } from "./tool-allowlist.js";
 export const GENERIC_TOOL_TROUBLE = "We couldn't run that just now. Try again in a moment.";
 export const TOOL_NOT_ALLOWED_MESSAGE = "That tool isn't available to Driggsby apps. Apps can use read-only tools like get_overview and list_accounts.";
 const MAX_TOOL_CALL_BODY_BYTES = 65_536;
+const PLAIN_TEXT = "text/plain; charset=utf-8";
+const JAVASCRIPT = "text/javascript; charset=utf-8";
 export async function startDevServers(options) {
     // Both origins bind and advertise 127.0.0.1: advertising "localhost"
     // while binding only the IPv4 loopback breaks on machines whose browser
     // resolves localhost to ::1 first.
     let appPortForGuard = 0;
-    // Filled in once the host server binds; app responses embed it in their
-    // frame-ancestors policy so only the real host page can frame the app.
+    // Filled in once the host server binds; app responses name it in their
+    // frame-ancestors and Allow-CSP-From, so only the real host page can
+    // frame the app.
     let hostOriginForFraming = "";
     const appServer = createServer((request, response) => {
         void handleAppRequest(options, appPortForGuard, hostOriginForFraming, request, response);
@@ -67,42 +72,53 @@ export async function startDevServers(options) {
     };
 }
 // ---------------------------------------------------------------------------
-// The app origin: the SDK path, then the project's own files.
+// The app origin: the SDK and font paths, then the project's own files.
 // ---------------------------------------------------------------------------
 async function handleAppRequest(options, appPort, hostOrigin, request, response) {
-    // Only the real host page may frame the app: without this, any other
-    // loopback-served page could embed the app origin, pin itself as the
-    // app's host, and feed it fabricated numbers. Until the host server has
-    // bound (a startup race measured in milliseconds), nothing may frame it.
-    // nosniff keeps the browser honest about the served content types.
-    const appHeaders = {
-        "Content-Security-Policy": `frame-ancestors ${hostOrigin === "" ? "'none'" : hostOrigin};`,
-        "X-Content-Type-Options": "nosniff",
-    };
+    // Every response carries the deployed app's headers (app-policy.ts). Their
+    // frame-ancestors lets only the real host page frame the app: without it,
+    // any other loopback-served page could embed the app origin, pin itself
+    // as the app's host, and feed it fabricated numbers.
+    const plainTextHeaders = appResponseHeaders(hostOrigin, PLAIN_TEXT);
     // Same rebinding guard as the host origin: a page on another site that
     // tricked DNS into pointing here carries its own Host, and fails.
     if (!hostHeaderIsLocal(request.headers.host, appPort)) {
-        sendText(response, 403, "text/plain; charset=utf-8", "Forbidden.", appHeaders);
+        sendText(response, 403, PLAIN_TEXT, "Forbidden.", plainTextHeaders);
+        return;
+    }
+    // Every service worker script request, whatever path it names, gets the
+    // inert worker (app-policy.ts), as deployed. Browsers mark each one.
+    if (isServiceWorkerScriptRequest(request)) {
+        sendText(response, 200, JAVASCRIPT, INERT_SERVICE_WORKER, appResponseHeaders(hostOrigin, JAVASCRIPT));
         return;
     }
     const path = requestPath(request);
     if (request.method !== "GET" && request.method !== "HEAD") {
-        sendText(response, 405, "text/plain; charset=utf-8", "Method not allowed.", appHeaders);
+        sendText(response, 405, PLAIN_TEXT, "Method not allowed.", plainTextHeaders);
         return;
     }
     if (path === "/-/driggsby-sdk.js") {
-        sendText(response, 200, "text/javascript; charset=utf-8", options.sdkBundle, appHeaders);
+        sendText(response, 200, JAVASCRIPT, options.sdkBundle, appResponseHeaders(hostOrigin, JAVASCRIPT));
+        return;
+    }
+    if (path === DASHBOARD_FONT_PATH) {
+        response.writeHead(200, {
+            "Content-Type": DASHBOARD_FONT_TYPE,
+            "Cache-Control": "no-store",
+            ...appResponseHeaders(hostOrigin, DASHBOARD_FONT_TYPE),
+        });
+        response.end(options.dashboardFont);
         return;
     }
     const file = await serveStaticFile(options.serveDirectory, path);
     if (file === null) {
-        sendText(response, 404, "text/plain; charset=utf-8", "Not found.", appHeaders);
+        sendText(response, 404, PLAIN_TEXT, "Not found.", plainTextHeaders);
         return;
     }
     response.writeHead(file.status, {
         "Content-Type": file.contentType,
         "Cache-Control": "no-store",
-        ...appHeaders,
+        ...appResponseHeaders(hostOrigin, file.contentType),
     });
     response.end(file.body);
 }
@@ -117,6 +133,12 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         sendJson(response, 403, { ok: false, error: { message: "Forbidden." } });
         return;
     }
+    // The host page registers no worker, so a worker script request here is
+    // a foreign one; the inert worker replaces it (app-policy.ts).
+    if (isServiceWorkerScriptRequest(request)) {
+        sendText(response, 200, JAVASCRIPT, INERT_SERVICE_WORKER);
+        return;
+    }
     const path = requestPath(request);
     if (request.method === "GET" && path === DEV_IDENTITY_PATH) {
         // Lets `dev --stop` (and `dev`) confirm that a record in ~/.driggsby
@@ -129,7 +151,7 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         return;
     }
     if (request.method === "GET" && path === "/host.js") {
-        sendText(response, 200, "text/javascript; charset=utf-8", HOST_PAGE_JS);
+        sendText(response, 200, JAVASCRIPT, HOST_PAGE_JS);
         return;
     }
     if (request.method === "GET" && path === "/events") {
@@ -150,7 +172,7 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         await handleToolCall(options, hostPort, request, response);
         return;
     }
-    sendText(response, 404, "text/plain; charset=utf-8", "Not found.");
+    sendText(response, 404, PLAIN_TEXT, "Not found.");
     return;
 }
 async function handleToolCall(options, hostPort, request, response) {
@@ -209,6 +231,9 @@ function requestPath(request) {
     const queryStart = url.indexOf("?");
     return queryStart === -1 ? url : url.slice(0, queryStart);
 }
+function isServiceWorkerScriptRequest(request) {
+    return request.headers["service-worker"] === "script" || request.headers["sec-fetch-dest"] === "serviceworker";
+}
 function hostHeaderIsLocal(host, port) {
     return host === `localhost:${String(port)}` || host === `127.0.0.1:${String(port)}`;
 }

package/dist/dev/host-page.js

@@ -5,6 +5,7 @@
 // inside Driggsby. The page carries no token and no data; every tool call
 // goes to the CLI's own /tool-calls endpoint, which holds the token and
 // enforces the allowlist and bounds.
+import { FRAME_POLICY } from "./app-policy.js";
 // The page's script is served as its own file so the page can carry a
 // Content-Security-Policy with no inline scripts.
 //
@@ -14,7 +15,11 @@
 // `appOrigin` is built by startDevServers from a literal plus a bound port
 // number, and `background` has passed readProjectConfig's strict hex-color
 // rule (or is null). Anything looser than those sources must not be
-// passed here.
+// passed here. FRAME_POLICY is a constant with no double quote in it.
+//
+// The frame gets the console's sandbox and, as its csp attribute, the
+// deployed policy (app-policy.ts), which Chrome then requires of every
+// document the frame shows, even one this server didn't send.
 export function hostPageHtml(slug, appOrigin, background) {
     return `<!doctype html>
 <html lang="en" data-app-origin="${appOrigin}">
@@ -84,7 +89,7 @@ export function hostPageHtml(slug, appOrigin, background) {
     <span class="slug">${slug}</span>
     <span class="mode">driggsby dev — your live data</span>
   </header>
-  <iframe id="app" src="${appOrigin}/" sandbox="allow-scripts allow-same-origin allow-forms"></iframe>
+  <iframe id="app" src="${appOrigin}/" sandbox="allow-scripts allow-same-origin" csp="${FRAME_POLICY}"></iframe>
   <script type="module" src="/host.js"></script>
 </body>
 </html>

package/dist/init/template-styles.js

@@ -5,9 +5,11 @@
 // console's stylesheet, so each gray is written as the console paints it
 // on its black page (the console's cards and fills are translucent over
 // that ground) and each hue verbatim. The :root block is the same one
-// Driggsby's own example dashboard carries. --bg-app must stay equal to
-// driggsby.json's "background" (init-command.test.ts pins the two
-// together): Driggsby paints that color while the app loads.
+// Driggsby's own example dashboard carries, --font-sans leading with
+// Inter, the face Driggsby serves every app (dev/dashboard-font.ts).
+// --bg-app must stay equal to driggsby.json's "background"
+// (init-command.test.ts pins the two together): Driggsby paints that color
+// while the app loads.
 export const STYLES_CSS = `/* Driggsby's console palette, so this page reads as part of the app it
    opens inside. Change these together if you re-theme; keep --bg-app equal
    to the "background" in driggsby.json. The status tones are the
@@ -28,10 +30,27 @@ export const STYLES_CSS = `/* Driggsby's console palette, so this page reads as
   --text-error: oklch(0.8 0.13 25);
   --radius-card: 8px;
   --radius-bar: 4px;
-  --font-sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+  --font-sans: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
   --ease: cubic-bezier(0.2, 0, 0, 1);
 }
 
+/* Inter, which Driggsby serves at /-/inter.woff2 on this app's own origin
+   (driggsby dev serves the same file there), so nothing loads from another
+   site. Keep the page's text set in it: the Dashboards page shows a
+   picture of this page, taken on a server with none of your fonts, and
+   only a font the page loads itself looks the same there. Fonts from other
+   sites are refused. To switch faces, put the font file in this folder,
+   point an @font-face at it, name it first in --font-sans, and change the
+   preload in index.html to match. Text waits for the font (font-display:
+   block, preloaded) rather than flash another face first. */
+@font-face {
+  font-family: "Inter";
+  src: url("/-/inter.woff2") format("woff2");
+  font-weight: 100 900;
+  font-style: normal;
+  font-display: block;
+}
+
 * {
   box-sizing: border-box;
 }

package/dist/init/templates.js

@@ -15,6 +15,7 @@ export function indexHtml(slug) {
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>${slug}</title>
+  <link rel="preload" href="/-/inter.woff2" as="font" type="font/woff2" crossorigin>
   <link rel="stylesheet" href="styles.css">
 </head>
 <body>

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "driggsby",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Set up and build on Driggsby, the MCP server for personal finance.",
-  "license": "Apache-2.0",
+  "license": "Apache-2.0 AND OFL-1.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/driggsby/driggsby.git"
@@ -13,6 +13,8 @@
     "driggsby": "bin/driggsby.js"
   },
   "files": [
+    "assets/Inter.woff2",
+    "assets/Inter-LICENSE.txt",
     "bin",
     "dist",
     "LICENSE",
@@ -28,7 +30,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@driggsby/deploy": "0.7.0",
-    "@driggsby/sdk": "0.7.0"
+    "@driggsby/deploy": "0.7.2",
+    "@driggsby/sdk": "0.7.2"
   }
 }