humanish 0.105.0 → 0.106.1

package/dist/observer-serve.js

@@ -1,284 +0,0 @@
-import { listenOnLoopback, PortInUseError } from "./listen.js";
-import { createServer } from "node:http";
-import { lstat } from "node:fs/promises";
-import path from "node:path";
-import { buildHistoryIndex, matchRunRoute, pinDirectChildDirectory, pinDirectory, serveRunPath } from "./observer.js";
-import { renderLibraryHtml } from "./observer-library.js";
-import { buildServeSecurityHeaders, hostAllowed, parsePublicOrigin } from "./serve-http.js";
-import { listRuns, verifyRun } from "./run.js";
-export const SERVE_SCHEMA = "humanish.serve-result.v1";
-// Re-exported for compat: these hardening primitives now live in serve-http.js so the live Observer
-// server can share them without a module cycle.
-export { buildServeSecurityHeaders, hostAllowed, parsePublicOrigin };
-export function createShareSafetyAdmission(cwd, options = {}) {
-    const verifyImpl = options.verifyImpl ?? verifyRun;
-    const now = options.now ?? (() => Date.now());
-    // verifyRun scans the ENTIRE run tree, but the cache key is run.json's stat
-    // identity, so an out-of-band edit to a scanned artifact that leaves run.json
-    // untouched would otherwise keep a stale share_ready verdict. A short TTL
-    // bounds that window: any mutation is re-scanned within ttlMs even when
-    // run.json never changes. Defense in depth on top of pre-persist redaction.
-    const ttlMs = options.ttlMs ?? 30_000;
-    const cache = new Map();
-    const bundleIdentity = async (runId) => {
-        try {
-            const stats = await lstat(path.join(cwd, ".humanish", "runs", runId, "run.json"), { bigint: true });
-            if (!stats.isFile()) {
-                return null;
-            }
-            return `${stats.dev}:${stats.ino}:${stats.mtimeNs}:${stats.size}`;
-        }
-        catch {
-            return null;
-        }
-    };
-    return {
-        async admit(runId) {
-            const identity = await bundleIdentity(runId);
-            if (!identity) {
-                cache.delete(runId);
-                return false;
-            }
-            const cached = cache.get(runId);
-            if (cached && cached.identity === identity && now() - cached.verifiedAt < ttlMs) {
-                return cached.admitted;
-            }
-            const admitted = verifyImpl(cwd, runId)
-                .then((verified) => verified.ok === true && verified.shareSafety.status === "share_ready")
-                .catch(() => false);
-            cache.set(runId, { identity, verifiedAt: now(), admitted });
-            return admitted;
-        }
-    };
-}
-export function createServeRequestHandler(options) {
-    return async (request, response) => {
-        try {
-            for (const [name, value] of Object.entries(buildServeSecurityHeaders())) {
-                response.setHeader(name, value);
-            }
-            const method = request.method ?? "GET";
-            if (method !== "GET" && method !== "HEAD") {
-                writeText(response, 405, "Method Not Allowed");
-                return;
-            }
-            if (!hostAllowed(request.headers.host, options.hostAllowlist)) {
-                writeText(response, 421, "Misdirected Request");
-                return;
-            }
-            const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
-            if (url.pathname === "/_humanish/api" || url.pathname.startsWith("/_humanish/api/")) {
-                writeText(response, 501, `${JSON.stringify({
-                    error: {
-                        code: "HUMANISH_SERVE_CONTROL_PLANE_DISABLED",
-                        message: "control plane not enabled in this version"
-                    }
-                }, null, 2)}\n`, "application/json; charset=utf-8");
-                return;
-            }
-            if (url.pathname === "/") {
-                if (options.entryRunId) {
-                    response.writeHead(302, {
-                        location: `/_humanish/runs/${encodeURIComponent(options.entryRunId)}/observer/index.html`
-                    });
-                    response.end();
-                    return;
-                }
-                const history = await loadFilteredHistory(options);
-                writeText(response, 200, options.renderLibrary(history), "text/html; charset=utf-8");
-                return;
-            }
-            if (url.pathname === "/_humanish/history.json") {
-                const history = await loadFilteredHistory(options);
-                writeText(response, 200, JSON.stringify(history, null, 2), "application/json; charset=utf-8");
-                return;
-            }
-            if (url.pathname.startsWith("/_humanish/runs/")) {
-                const runRoute = matchRunRoute(url.pathname);
-                if (!runRoute) {
-                    writeText(response, 404, "Run not found");
-                    return;
-                }
-                if (options.safe && !(await options.admit(runRoute.runId))) {
-                    // Byte-identical to the nonexistent-run 404: no existence oracle.
-                    writeText(response, 404, "Run not found");
-                    return;
-                }
-                const targetRoot = await pinDirectChildDirectory(options.proofRoot, runRoute.runId);
-                if (!targetRoot) {
-                    writeText(response, 404, "Run not found");
-                    return;
-                }
-                // The explicit empty runtimeStreamUrls keeps a future refactor from
-                // reintroducing auth-keyed stream injection on the serve surface.
-                await serveRunPath(targetRoot, runRoute.relativePath || "observer/index.html", response, [], request);
-                return;
-            }
-            writeText(response, 404, "Not found");
-        }
-        catch {
-            writeText(response, 500, "Observer request failed");
-        }
-    };
-}
-async function loadFilteredHistory(options) {
-    const history = await buildHistoryIndex(options.proofRoot);
-    if (!options.safe) {
-        return history;
-    }
-    const admissions = await Promise.all(history.runs.map(async (run) => ((await options.admit(run.runId)) === true ? run : null)));
-    const runs = admissions.filter((run) => run !== null);
-    const latestRunId = runs.some((run) => run.runId === history.latestRunId)
-        ? history.latestRunId
-        : runs[0]?.runId ?? null;
-    return { latestRunId, runs };
-}
-export async function serveObserverLibrary(cwdInput, options) {
-    const cwd = path.resolve(cwdInput);
-    const verifyImpl = options.verifyImpl ?? verifyRun;
-    let proofRoot;
-    try {
-        proofRoot = await pinDirectory(path.join(cwd, ".humanish", "runs"));
-    }
-    catch {
-        return {
-            ok: false,
-            error: {
-                code: "HUMANISH_RUN_NOT_FOUND",
-                message: "No run library found under .humanish/runs. Run `humanish watch` to create the first run."
-            }
-        };
-    }
-    const admission = createShareSafetyAdmission(cwd, {
-        verifyImpl,
-        ...(options.now ? { now: options.now } : {})
-    });
-    // Exposure auth is tunnel-edge only. Under --expose, an edge-authed surface (ngrok --oauth or an
-    // operator --public-url) serves every run (mode "exposed"); an un-authed surface is admissible
-    // only because --safe narrows it to share_ready runs (mode "share-safe-open").
-    const mode = options.expose
-        ? options.edgeAuthed ? "exposed" : "share-safe-open"
-        : "loopback";
-    let entryRunId;
-    if (options.entryRunId) {
-        const resolved = options.entryRunId === "latest"
-            ? (await listRuns(cwd)).latest ?? null
-            : options.entryRunId;
-        const pinned = resolved ? await pinDirectChildDirectory(proofRoot, resolved) : null;
-        if (!resolved || !pinned) {
-            return {
-                ok: false,
-                error: { code: "HUMANISH_RUN_NOT_FOUND", message: `Run not found: ${options.entryRunId}` }
-            };
-        }
-        if (options.safe && !(await admission.admit(resolved))) {
-            const verified = await verifyImpl(cwd, resolved).catch(() => null);
-            const status = verified?.shareSafety.status ?? "unverifiable";
-            const reasons = verified?.shareSafety.reasons.map((reason) => reason.code).join(", ") || "VERIFY_FAILED";
-            return {
-                ok: false,
-                error: {
-                    code: "HUMANISH_SERVE_RUN_NOT_SHAREABLE",
-                    message: `Run ${resolved} is not share_ready (shareSafety: ${status}; reasons: ${reasons}); --safe refuses to serve it.`
-                }
-            };
-        }
-        entryRunId = resolved;
-    }
-    // Counts are computed over the UNCAPPED run list, not the 80-item history
-    // index: an edge-authed surface (non-safe) grants access to every run by direct
-    // URL, and share-safe modes admit every share_ready run per request, so a
-    // count capped at 80 would understate exactly what the exposure warning
-    // claims. runsListed feeds the operator's declared-friction warning.
-    const allRuns = (await listRuns(cwd)).runs;
-    let runsListed;
-    let shareReadyCount;
-    if (options.safe) {
-        const admitted = await Promise.all(allRuns.map((run) => admission.admit(run.runId)));
-        shareReadyCount = admitted.filter(Boolean).length;
-        runsListed = shareReadyCount;
-    }
-    else {
-        runsListed = allRuns.length;
-    }
-    const declaredOrigin = options.publicOrigin ? parsePublicOrigin(options.publicOrigin) : null;
-    const hostAllowlist = new Set();
-    const handler = createServeRequestHandler({
-        proofRoot,
-        safe: options.safe,
-        admit: (runId) => admission.admit(runId),
-        hostAllowlist,
-        ...(entryRunId ? { entryRunId } : {}),
-        renderLibrary: (history) => renderLibraryHtml(history, {
-            mode,
-            safe: options.safe,
-            capabilities: { actions: false }
-        }),
-        ...(options.controlPlane ? { controlPlane: options.controlPlane } : {})
-    });
-    const server = createServer((request, response) => {
-        void handler(request, response);
-    });
-    let port;
-    try {
-        port = await listenOnLoopback(server, options.port);
-    }
-    catch (error) {
-        if (error instanceof PortInUseError) {
-            // The most expected failure a serve command has, named instead of HUMANISH_UNEXPECTED (#484).
-            return { ok: false, error: { code: "HUMANISH_SERVE_PORT_IN_USE", message: error.message } };
-        }
-        throw error;
-    }
-    hostAllowlist.add(`127.0.0.1:${port}`);
-    hostAllowlist.add(`localhost:${port}`);
-    hostAllowlist.add(`[::1]:${port}`);
-    if (declaredOrigin) {
-        hostAllowlist.add(declaredOrigin.host);
-    }
-    return {
-        ok: true,
-        server: {
-            url: `http://127.0.0.1:${port}/`,
-            port,
-            mode,
-            runsListed,
-            ...(shareReadyCount !== undefined ? { shareReadyCount } : {}),
-            ...(entryRunId ? { entryRunId } : {}),
-            // A tunnel's public origin is only known after the tunnel starts (post bind); this lets the
-            // caller declare it, extending the Host allowlist so the authenticated edge forwarding under
-            // that Host is admitted. Never flips any in-process auth flag (there is none).
-            addPublicOrigin(origin) {
-                const parsed = parsePublicOrigin(origin);
-                if (!parsed) {
-                    return;
-                }
-                hostAllowlist.add(parsed.host);
-            },
-            close: async () => {
-                const closed = closeServer(server);
-                // Keep-alive sockets would otherwise keep close() pending past the point
-                // the operator believes Ctrl-C tore the server down.
-                server.closeAllConnections?.();
-                await closed;
-            }
-        }
-    };
-}
-function writeText(response, status, body, contentType = "text/plain; charset=utf-8") {
-    response.writeHead(status, { "content-type": contentType });
-    response.end(body);
-}
-function closeServer(server) {
-    return new Promise((resolve, reject) => {
-        server.close((error) => {
-            if (error) {
-                reject(error);
-            }
-            else {
-                resolve();
-            }
-        });
-    });
-}
-//# sourceMappingURL=observer-serve.js.map

package/dist/observer-serve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"observer-serve.js","sourceRoot":"","sources":["../src/observer-serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,iBAAiB,EAAkB,MAAM,iBAAiB,CAAC;AAE5G,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,CAAC,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEvD,oGAAoG;AACpG,gDAAgD;AAChD,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;AA8CrE,MAAM,UAAU,0BAA0B,CACxC,GAAW,EACX,UAAiF,EAAE;IAEnF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgF,CAAC;IAEtG,MAAM,cAAc,GAAG,KAAK,EAAE,KAAa,EAA0B,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAa;YACvB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;gBAChF,OAAO,MAAM,CAAC,QAAQ,CAAC;YACzB,CAAC;YAED,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;iBACpC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,aAAa,CAAC;iBACzF,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,MAAM,UAAU,yBAAyB,CACvC,OAAmC;IAEnC,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;gBACxE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;YACvC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1C,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9D,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;YAEzF,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpF,SAAS,CACP,QAAQ,EACR,GAAG,EACH,GAAG,IAAI,CAAC,SAAS,CAAC;oBAChB,KAAK,EAAE;wBACL,IAAI,EAAE,uCAAuC;wBAC7C,OAAO,EAAE,2CAA2C;qBACrD;iBACF,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACf,iCAAiC,CAClC,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACzB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBACvB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;wBACtB,QAAQ,EAAE,mBAAmB,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB;qBAC1F,CAAC,CAAC;oBACH,QAAQ,CAAC,GAAG,EAAE,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACnD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,yBAAyB,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACnD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC3D,kEAAkE;oBAClE,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACpF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBACD,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,YAAY,IAAI,qBAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YAED,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAmC;IACpE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC1F,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAyC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,WAAW,CAAC;QACvE,CAAC,CAAC,OAAO,CAAC,WAAW;QACrB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC3B,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAgCD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,OAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;IAEnD,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,0FAA0F;aACpG;SACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,EAAE;QAChD,UAAU;QACV,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,iGAAiG;IACjG,+FAA+F;IAC/F,+EAA+E;IAC/E,MAAM,IAAI,GAAc,OAAO,CAAC,MAAM;QACpC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB;QACpD,CAAC,CAAC,UAAU,CAAC;IAEf,IAAI,UAA8B,CAAC;IACnC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ;YAC9C,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI;YACtC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,kBAAkB,OAAO,CAAC,UAAU,EAAE,EAAE;aAC3F,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,cAAc,CAAC;YAC9D,MAAM,OAAO,GAAG,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC;YACzG,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,OAAO,QAAQ,qCAAqC,MAAM,cAAc,OAAO,gCAAgC;iBACzH;aACF,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,IAAI,UAAkB,CAAC;IACvB,IAAI,eAAmC,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAClD,UAAU,GAAG,eAAe,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7F,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QACxC,aAAa;QACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE;YACrD,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SACjC,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,KAAK,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,8FAA8F;YAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACvC,aAAa,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACvC,aAAa,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,cAAc,EAAE,CAAC;QACnB,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,GAAG,EAAE,oBAAoB,IAAI,GAAG;YAChC,IAAI;YACJ,IAAI;YACJ,UAAU;YACV,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,4FAA4F;YAC5F,6FAA6F;YAC7F,+EAA+E;YAC/E,eAAe,CAAC,MAAc;gBAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnC,yEAAyE;gBACzE,qDAAqD;gBACrD,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC/B,MAAM,MAAM,CAAC;YACf,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,QAAwB,EACxB,MAAc,EACd,IAAY,EACZ,WAAW,GAAG,2BAA2B;IAEzC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAGD,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACrB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/observer-static.js

@@ -1,357 +0,0 @@
-import { constants as fsConstants } from "node:fs";
-import { createServer } from "node:http";
-import { lstat, open, realpath } from "node:fs/promises";
-import path from "node:path";
-import { buildArtifactSecurityHeaders } from "./serve-http.js";
-// Loopback-only host for the Observer static server. We never bind 0.0.0.0:
-// the Observer surfaces local run evidence and must stay reachable only from
-// the machine that owns the run bundle.
-export const OBSERVER_STATIC_HOST = "127.0.0.1";
-// Minimal extension -> content-type map. Kept dependency-free (no `mime`
-// package) because the Observer ships a small, known set of asset kinds.
-const CONTENT_TYPES = {
-    ".html": "text/html; charset=utf-8",
-    ".htm": "text/html; charset=utf-8",
-    ".js": "text/javascript; charset=utf-8",
-    ".mjs": "text/javascript; charset=utf-8",
-    ".css": "text/css; charset=utf-8",
-    ".json": "application/json; charset=utf-8",
-    ".map": "application/json; charset=utf-8",
-    ".svg": "image/svg+xml",
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".webp": "image/webp",
-    ".gif": "image/gif",
-    ".ico": "image/x-icon",
-    ".md": "text/markdown; charset=utf-8",
-    ".ndjson": "application/x-ndjson; charset=utf-8",
-    ".txt": "text/plain; charset=utf-8",
-    ".woff": "font/woff",
-    ".woff2": "font/woff2"
-};
-export function observerStaticContentType(filePath) {
-    return CONTENT_TYPES[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
-}
-/**
- * Resolve, guard, and serve a single static request from `root`. Never throws:
- * any unexpected failure is reported as a 500 so the connection always closes.
- * Exported directly so the security guards can be unit-tested without binding a
- * socket.
- */
-export async function respondToObserverStaticRequest(options, request, response) {
-    applySecurityHeaders(response);
-    try {
-        const root = await pinStaticRoot(options.root);
-        await respondToPinnedObserverStaticRequest(root, options, request, response);
-    }
-    catch {
-        if (response.headersSent) {
-            response.end();
-            return;
-        }
-        writeText(response, 500, "Observer request failed");
-    }
-}
-async function respondToPinnedObserverStaticRequest(root, options, request, response) {
-    applySecurityHeaders(response);
-    const indexRelative = options.indexPath ?? "index.html";
-    try {
-        await assertPinnedStaticRoot(root);
-        const method = request.method ?? "GET";
-        if (method !== "GET" && method !== "HEAD") {
-            writeText(response, 405, "Method Not Allowed");
-            return;
-        }
-        let pathname;
-        try {
-            pathname = new URL(request.url ?? "/", `http://${OBSERVER_STATIC_HOST}`).pathname;
-        }
-        catch {
-            writeText(response, 400, "Bad Request");
-            return;
-        }
-        if (pathname === "/" && options.redirectRootTo) {
-            const location = `/${options.redirectRootTo.replace(/^\/+/, "")}`;
-            response.writeHead(302, {
-                location,
-                "cache-control": "no-store",
-                "content-length": "0"
-            });
-            response.end();
-            return;
-        }
-        let decoded;
-        try {
-            decoded = decodeURIComponent(pathname);
-        }
-        catch {
-            writeText(response, 400, "Bad Request");
-            return;
-        }
-        // Reject embedded NUL bytes outright rather than letting them reach the fs.
-        if (decoded.includes("\0")) {
-            writeText(response, 400, "Bad Request");
-            return;
-        }
-        let relative = decoded.replace(/^\/+/, "");
-        if (relative === "" || relative.endsWith("/")) {
-            relative = `${relative}${indexRelative}`;
-        }
-        const target = path.resolve(root.physicalPath, relative);
-        if (!isPathInside(root.physicalPath, target)) {
-            writeText(response, 403, "Forbidden");
-            return;
-        }
-        let info;
-        try {
-            info = await lstat(target);
-        }
-        catch {
-            writeText(response, 404, "Not Found");
-            return;
-        }
-        if (info.isSymbolicLink()) {
-            writeText(response, 403, "Forbidden");
-            return;
-        }
-        let filePath = target;
-        if (info.isDirectory()) {
-            filePath = path.resolve(target, indexRelative);
-            if (!isPathInside(root.physicalPath, filePath)) {
-                writeText(response, 403, "Forbidden");
-                return;
-            }
-        }
-        const rawBody = await readContainedRegularFile(root, filePath);
-        const body = rawBody ? recordedObserverStaticBody(filePath, rawBody) : null;
-        if (!body) {
-            writeText(response, 404, "Not Found");
-            return;
-        }
-        response.writeHead(200, {
-            "cache-control": "no-store",
-            "content-type": observerStaticContentType(filePath),
-            "content-length": String(body.byteLength)
-        });
-        if (method === "HEAD") {
-            response.end();
-            return;
-        }
-        response.end(body);
-    }
-    catch {
-        if (response.headersSent) {
-            response.end();
-            return;
-        }
-        writeText(response, 500, "Observer request failed");
-    }
-}
-function applySecurityHeaders(response) {
-    for (const [name, value] of Object.entries(buildArtifactSecurityHeaders()))
-        response.setHeader(name, value);
-}
-/** Static serving is recorded evidence. Neither JSON files nor inline HTML snapshots
- * can carry a live process observation or grant provider-origin access. */
-function recordedObserverStaticBody(filePath, body) {
-    const strip = (text) => {
-        try {
-            const data = JSON.parse(text);
-            if (!data || typeof data !== "object" || Array.isArray(data)
-                || data.schema !== "humanish.observer-data.v1")
-                return null;
-            const projection = data;
-            delete projection.runtime;
-            if (Array.isArray(projection.streams)) {
-                for (const stream of projection.streams) {
-                    if (!stream || typeof stream !== "object" || Array.isArray(stream))
-                        continue;
-                    const embed = stream.embed;
-                    if (embed && typeof embed === "object" && !Array.isArray(embed))
-                        delete embed.runtimeDesktop;
-                }
-            }
-            return JSON.stringify(projection).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026");
-        }
-        catch {
-            return null;
-        }
-    };
-    if (path.basename(filePath) === "observer-data.json") {
-        const stripped = strip(body.toString("utf8"));
-        return stripped === null ? body : Buffer.from(stripped);
-    }
-    if (/\.html?$/i.test(filePath)) {
-        const html = body.toString("utf8");
-        // Identify Observer JSON by its schema, not an attribute spelling: HTML permits
-        // encoded ids and '>' inside quoted attributes. Other scripts remain byte-identical.
-        const sanitized = html.replace(/(<script\b(?:[^>"']|"[^"]*"|'[^']*')*>)([\s\S]*?)(<\/script\s*>)/gi, (match, start, json, end) => {
-            const stripped = strip(json);
-            return stripped === null ? match : `${start}${stripped}${end}`;
-        });
-        return sanitized === html ? body : Buffer.from(sanitized);
-    }
-    return body;
-}
-async function readContainedRegularFile(root, filePathInput) {
-    const filePath = path.resolve(filePathInput);
-    if (!isPathInside(root.physicalPath, filePath))
-        return null;
-    try {
-        await assertPinnedStaticRoot(root);
-        const expectedStats = await inspectContainedStaticFile(root, filePath);
-        if (!expectedStats) {
-            return null;
-        }
-        const handle = await open(filePath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-        try {
-            const openedStats = await handle.stat({ bigint: true });
-            if (!openedStats.isFile()
-                || openedStats.nlink !== 1n
-                || openedStats.dev !== expectedStats.dev
-                || openedStats.ino !== expectedStats.ino) {
-                return null;
-            }
-            const recheckedStats = await inspectContainedStaticFile(root, filePath);
-            if (!recheckedStats
-                || recheckedStats.dev !== expectedStats.dev
-                || recheckedStats.ino !== expectedStats.ino) {
-                return null;
-            }
-            await assertPinnedStaticRoot(root);
-            const body = await handle.readFile();
-            await assertPinnedStaticRoot(root);
-            return body;
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch {
-        return null;
-    }
-}
-export function createObserverStaticHandler(options) {
-    let rootPromise;
-    return (request, response) => {
-        applySecurityHeaders(response);
-        rootPromise ??= pinStaticRoot(options.root);
-        void rootPromise
-            .then((root) => respondToPinnedObserverStaticRequest(root, options, request, response))
-            .catch(() => {
-            if (response.headersSent) {
-                response.end();
-                return;
-            }
-            writeText(response, 500, "Observer request failed");
-        });
-    };
-}
-export async function serveObserverStatic(options) {
-    const entryPath = options.entryPath?.replace(/^\/+/, "") ?? "";
-    const handlerOptions = {
-        root: options.root,
-        ...(options.indexPath === undefined ? {} : { indexPath: options.indexPath }),
-        ...(entryPath ? { redirectRootTo: entryPath } : {})
-    };
-    const root = await pinStaticRoot(options.root);
-    const handler = (request, response) => {
-        void respondToPinnedObserverStaticRequest(root, handlerOptions, request, response);
-    };
-    const server = createServer(handler);
-    const port = await listen(server, options.port ?? 0);
-    return {
-        url: `http://${OBSERVER_STATIC_HOST}:${port}/${entryPath}`,
-        port,
-        host: OBSERVER_STATIC_HOST,
-        close: () => closeServer(server)
-    };
-}
-function writeText(response, status, message) {
-    const body = `${message}\n`;
-    response.writeHead(status, {
-        "cache-control": "no-store",
-        "content-type": "text/plain; charset=utf-8",
-        "content-length": String(Buffer.byteLength(body))
-    });
-    response.end(body);
-}
-function isPathInside(root, candidate) {
-    const relative = path.relative(root, candidate);
-    return relative === ""
-        || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
-}
-async function inspectContainedStaticFile(root, filePath) {
-    const relative = path.relative(root.physicalPath, filePath);
-    if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-        return null;
-    }
-    const segments = relative.split(path.sep).filter(Boolean);
-    let current = root.physicalPath;
-    let fileIdentity = null;
-    for (const [index, segment] of segments.entries()) {
-        current = path.join(current, segment);
-        const stats = await lstat(current, { bigint: true });
-        if (stats.isSymbolicLink())
-            return null;
-        if (index < segments.length - 1) {
-            if (!stats.isDirectory())
-                return null;
-        }
-        else {
-            if (!stats.isFile() || stats.nlink !== 1n)
-                return null;
-            fileIdentity = { dev: stats.dev, ino: stats.ino };
-        }
-    }
-    if (await realpath(filePath) !== filePath)
-        return null;
-    return fileIdentity;
-}
-async function pinStaticRoot(rootInput) {
-    const physicalPath = await realpath(path.resolve(rootInput));
-    const stats = await lstat(physicalPath, { bigint: true });
-    if (stats.isSymbolicLink() || !stats.isDirectory()) {
-        throw new Error("Observer static roots must be physical directories.");
-    }
-    return Object.freeze({ birthtimeNs: stats.birthtimeNs, dev: stats.dev, ino: stats.ino, physicalPath });
-}
-async function assertPinnedStaticRoot(root) {
-    const stats = await lstat(root.physicalPath, { bigint: true });
-    if (stats.isSymbolicLink()
-        || !stats.isDirectory()
-        || stats.birthtimeNs !== root.birthtimeNs
-        || stats.dev !== root.dev
-        || stats.ino !== root.ino
-        || await realpath(root.physicalPath) !== root.physicalPath) {
-        throw new Error("Observer static root identity changed.");
-    }
-}
-function listen(server, port) {
-    return new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(port, OBSERVER_STATIC_HOST, () => {
-            server.off("error", reject);
-            const address = server.address();
-            if (!address || typeof address === "string") {
-                reject(new Error("Observer static server did not bind to a TCP port."));
-                return;
-            }
-            resolve(address.port);
-        });
-    });
-}
-function closeServer(server) {
-    return new Promise((resolve, reject) => {
-        server.close((error) => {
-            if (error) {
-                reject(error);
-            }
-            else {
-                resolve();
-            }
-        });
-    });
-}
-//# sourceMappingURL=observer-static.js.map