lastlight 0.16.0 → 0.16.2

package/dist/admin/index.d.ts

@@ -1,9 +0,0 @@
-import { Hono } from "hono";
-import type { StateDb } from "../state/db.js";
-import { type AdminConfig } from "./routes.js";
-export { type AdminConfig } from "./routes.js";
-/**
- * Mount admin routes and dashboard static files onto the given Hono app.
- * This mounts directly so paths like /admin/assets/* resolve correctly.
- */
-export declare function mountAdmin(app: Hono, db: StateDb, config: AdminConfig): void;

package/dist/admin/index.js

@@ -1,59 +0,0 @@
-import { serveStatic } from "@hono/node-server/serve-static";
-import { SessionReader } from "./sessions.js";
-import { ChatSessionReader } from "./chat-session-reader.js";
-import { createAdminRoutes, binaryMimeForArtifact, rangeResponse } from "./routes.js";
-import { SessionLog } from "../session-log.js";
-import { BuildAssetStore } from "../state/build-assets.js";
-/**
- * Mount admin routes and dashboard static files onto the given Hono app.
- * This mounts directly so paths like /admin/assets/* resolve correctly.
- */
-export function mountAdmin(app, db, config) {
-    const sessionLog = new SessionLog(config.sessionsDir);
-    const sessions = new SessionReader(sessionLog, "sandbox");
-    // Chat is DB-backed: list comes from `executions` grouped by trigger_id
-    // (the Slack thread), and message reads target the single jsonl owned by
-    // that thread's agent_session_id rather than scanning every file in -app.
-    const chatSessions = new ChatSessionReader(db, sessionLog);
-    const apiRoutes = createAdminRoutes(db, sessions, chatSessions, config);
-    // PUBLIC, unauthenticated, MEDIA-ONLY artifact route — registered on the
-    // PARENT app BEFORE the `/admin/api` sub-app so it never enters that sub-app's
-    // `authMiddleware`. Browser-QA screenshots AND `/demo` videos embedded in a
-    // GitHub comment must be fetchable with no login: GitHub's image proxy fetches
-    // <img> screenshots, and a viewer's browser streams <video> (sending `Range`
-    // requests — hence rangeResponse). Non-media docs 404, so text handoff docs
-    // (architect-plan.md, status.md, …) are NEVER exposed here — they stay behind
-    // auth at `/admin/api/artifacts/*`. `BuildAssetStore`'s per-segment validation
-    // blocks path traversal on every param.
-    // NOTE: this makes screenshots/videos of the served app publicly reachable by
-    // URL — acceptable for public repos; revisit (visibility check / signed token)
-    // before enabling for private repos.
-    const publicArtifactStore = config.buildAssetsDir
-        ? new BuildAssetStore(config.buildAssetsDir)
-        : null;
-    app.get("/admin/api/public/artifacts/:owner/:repo/:key/:doc", (c) => {
-        if (!publicArtifactStore)
-            return c.json({ error: "build-assets store not configured" }, 404);
-        const { owner, repo, key, doc } = c.req.param();
-        const mime = binaryMimeForArtifact(doc);
-        if (!mime)
-            return c.json({ error: `not found: ${doc}` }, 404); // media-only gate
-        try {
-            const buf = publicArtifactStore.readBuffer({ owner, repo, issueKey: key }, doc);
-            if (buf === undefined)
-                return c.json({ error: `not found: ${doc}` }, 404);
-            return rangeResponse(c.req.header("range"), buf, mime, "public, max-age=300");
-        }
-        catch (err) {
-            return c.json({ error: err instanceof Error ? err.message : String(err) }, 400);
-        }
-    });
-    // API at /admin/api/*
-    app.route("/admin/api", apiRoutes);
-    // Static dashboard assets at /admin/*
-    app.use("/admin/*", serveStatic({ root: "dashboard/dist", rewriteRequestPath: (p) => p.replace(/^\/admin/, "") }));
-    // SPA fallback — serve index.html for any /admin/* that didn't match above
-    app.get("/admin/*", serveStatic({ root: "dashboard/dist", path: "index.html" }));
-    app.get("/admin", serveStatic({ root: "dashboard/dist", path: "index.html" }));
-}
-//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,aAAa,EAAoB,MAAM,aAAa,CAAC;AACxG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAI3D;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAS,EAAE,EAAW,EAAE,MAAmB;IACpE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC1D,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAExE,yEAAyE;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,wCAAwC;IACxC,8EAA8E;IAC9E,+EAA+E;IAC/E,qCAAqC;IACrC,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc;QAC/C,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IACT,GAAG,CAAC,GAAG,CAAC,oDAAoD,EAAE,CAAC,CAAC,EAAE,EAAE;QAClE,IAAI,CAAC,mBAAmB;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,kBAAkB;QACjF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YAChF,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAEnC,sCAAsC;IACtC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnH,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC"}

package/dist/admin/routes.d.ts

@@ -1,81 +0,0 @@
-import { Hono } from "hono";
-import type { SessionSource } from "./sessions.js";
-import type { StateDb, WorkflowRun } from "../state/db.js";
-import type { CronScheduler } from "../cron/scheduler.js";
-import type { PublicConfigBundle, BuildAssetsLocation } from "../config/config.js";
-/**
- * Map a build-asset filename extension to a binary MIME type, or null when the
- * file should be served as text/plain (markdown handoff docs). Binary artifacts
- * — PNG screenshot evidence from browser QA, and `/demo`'s mp4/webm video — must
- * be served as raw bytes, not utf-8 text, so the dashboard can render them in an
- * <img>/<video> and GitHub can embed them.
- */
-export declare function binaryMimeForArtifact(name: string): string | null;
-/**
- * Build an HTTP response for a binary artifact buffer, honoring a `Range`
- * request so <video> elements can seek/stream (GitHub's inline player and
- * browsers send `Range: bytes=…`; without 206 support, seeking — and some
- * players — break). Artifacts are small (≤ a few MB), so we slice the in-memory
- * buffer rather than streaming from disk. Returns 206 for a satisfiable range,
- * 416 for an unsatisfiable one, else 200 with the full body. `Accept-Ranges:
- * bytes` is always advertised.
- */
-export declare function rangeResponse(rangeHeader: string | undefined, buf: Buffer, mime: string, cacheControl: string): Response;
-export interface AdminConfig {
-    stateDir: string;
-    sessionsDir: string;
-    /**
-     * Filesystem root for server-mode build assets (when `buildAssets.location:
-     * server`). The Artifacts endpoints read handoff docs from here. Absent when
-     * unconfigured — the endpoints then report the store as empty.
-     */
-    buildAssetsDir?: string;
-    /**
-     * Where build handoff docs live: "repo" (committed to the target repo) |
-     * "server" (externalized to the store). Drives the focused approval view's
-     * artifact ref: server mode → editable doc in the store; repo mode → a link
-     * to the file on GitHub. Defaults to "repo" when absent.
-     */
-    buildAssets?: BuildAssetsLocation;
-    adminPassword: string;
-    adminSecret: string;
-    publicConfig?: PublicConfigBundle;
-    /** Built-in asset root (the lastlight checkout). Used to compute which
-     *  overlay assets shadow a default vs add a new one (Config → Overrides). */
-    builtInRoot?: string;
-    /** Active deployment overlay root (`$LASTLIGHT_OVERLAY_DIR`), if any. */
-    overlayDir?: string;
-    /** Optional callback to actively resume a paused workflow after dashboard approval */
-    resumeWorkflow?: (workflowRun: WorkflowRun, sender: string) => Promise<void>;
-    /**
-     * Optional callback to retry a FAILED workflow run, resuming from the phase
-     * that failed with the same context (ledger-driven). Wired in `src/index.ts`;
-     * absent in environments without the runner (tests, CLI-only), in which case
-     * the retry endpoint reports 503.
-     */
-    retryWorkflow?: (workflowRun: WorkflowRun, sender: string) => Promise<void>;
-    /**
-     * Cron scheduler. When supplied, the admin Crons tab can list/toggle/edit
-     * registered cron jobs. Optional so the admin routes still mount in
-     * environments where the scheduler isn't running (tests, CLI).
-     */
-    cronScheduler?: CronScheduler;
-    /** Slack OAuth config (optional — enables "Login with Slack" on dashboard) */
-    slackOAuthClientId?: string;
-    slackOAuthClientSecret?: string;
-    slackOAuthRedirectUri?: string;
-    /** Restrict login to this Slack workspace team_id or team domain */
-    slackAllowedWorkspace?: string;
-    /** GitHub OAuth config (optional — enables "Login with GitHub" on dashboard) */
-    githubOAuthClientId?: string;
-    githubOAuthClientSecret?: string;
-    githubOAuthRedirectUri?: string;
-    /**
-     * Required when GitHub OAuth is configured. Either a GitHub org slug
-     * (restricts login to confirmed members — needs read:org scope) or the
-     * literal "*" to explicitly allow any authenticated GitHub user. If
-     * client id/secret are set but this is empty, GitHub OAuth is disabled.
-     */
-    githubAllowedOrg?: string;
-}
-export declare function createAdminRoutes(db: StateDb, sessions: SessionSource, chatSessions: SessionSource, config: AdminConfig): Hono;