lavish-axi 0.1.27 → 0.1.28

package/README.md

@@ -53,6 +53,7 @@ npx skills add kunchenguid/lavish-axi --skill lavish
 
 That is the entire setup - no npm install needed.
 The skill teaches your agent to run Lavish through `npx -y lavish-axi`, so the CLI comes along on demand.
+Its frontmatter also includes Hermes Agent metadata, so Hermes-compatible harnesses can categorize and surface it as a first-class productivity skill.
 
 Then, in agents that expose skills as slash commands (Claude Code, for example), invoke it directly:
 
@@ -143,6 +144,7 @@ pnpm link
 - **Server cleanup** - The detached server stops after the last session ends when nothing is connected, or after `LAVISH_AXI_IDLE_TIMEOUT_MS` (default 30 minutes) with no browser or poll connections.
   Set `LAVISH_AXI_IDLE_TIMEOUT_MS=0` or `off` to disable idle self-shutdown.
 - **Local-first state** - Session state stays under `.lavish-axi/` in the workspace.
+- **Network binding** - The server binds to loopback (`127.0.0.1`) by default. Set `LAVISH_AXI_HOST` to bind elsewhere; a wildcard (`0.0.0.0` or `::`) binds every interface. Binding beyond loopback exposes an unauthenticated server that can read and serve arbitrary local files to anything that can reach it, so only do so on a trusted network. Set `LAVISH_AXI_LINK_HOST` to control the hostname written into generated session links (defaults to the bind address, or loopback when bound to a wildcard).
 
 ## CLI Reference
 

package/dist/cli.mjs

@@ -474,6 +474,25 @@ import { mkdir } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 var LOOPBACK_HOST = "127.0.0.1";
+var IPV6_LOOPBACK_HOST = "::1";
+var WILDCARD_BIND_LOOPBACK = /* @__PURE__ */ new Map([
+  ["0.0.0.0", LOOPBACK_HOST],
+  ["::", IPV6_LOOPBACK_HOST]
+]);
+function bindHost(env = process.env) {
+  return env.LAVISH_AXI_HOST?.trim() || LOOPBACK_HOST;
+}
+function clientHost(env = process.env) {
+  const host = bindHost(env);
+  return WILDCARD_BIND_LOOPBACK.get(host) ?? host;
+}
+function linkHost(env = process.env) {
+  return env.LAVISH_AXI_LINK_HOST?.trim() || clientHost(env);
+}
+function hostForUrl(host) {
+  if (host.includes(":") && !host.startsWith("[")) return `[${host}]`;
+  return host;
+}
 function stateDir() {
   return process.env.LAVISH_AXI_STATE_DIR || path.join(os.homedir(), ".lavish-axi");
 }
@@ -1229,7 +1248,9 @@ async function serve({
   debug = false,
   log = null,
   pollHeartbeatMs = 15e3,
-  idleTimeoutMs = resolveIdleTimeoutMs()
+  idleTimeoutMs = resolveIdleTimeoutMs(),
+  host = bindHost(),
+  linkHost: linkHostName = linkHost()
 }) {
   const app = express();
   const store = new SessionStore(stateFile2);
@@ -1259,7 +1280,7 @@ async function serve({
     try {
       const file = await canonicalFile(req.body.file);
       const key = sessionKey(file);
-      const url = `http://${LOOPBACK_HOST}:${publicPort}/session/${key}`;
+      const url = `http://${hostForUrl(linkHostName)}:${publicPort}/session/${key}`;
       const existing = await store.findByKey(key);
       const session = await store.upsertSession(file, url);
       if (existing?.status === "ended") {
@@ -1532,8 +1553,11 @@ data: ${JSON.stringify({ state: computePresence(req.params.key, activePolls, del
   app.use((error, req, res, _next) => {
     res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
   });
-  const httpServer = await new Promise((resolve) => {
-    const s = app.listen(port, LOOPBACK_HOST, () => resolve(s));
+  const httpServer = await new Promise((resolve, reject) => {
+    const s = app.listen(port, host, () => {
+      if (s.address()) resolve(s);
+    });
+    s.once("error", reject);
   });
   publicPort = httpServer.address().port;
   let shuttingDown = false;
@@ -1947,7 +1971,7 @@ function normalizePagePath(path5) {
 // src/cli.js
 var COMMANDS = /* @__PURE__ */ new Set(["open", "poll", "end", "stop", "server", "playbook", "design", "setup"]);
 var DESCRIPTION = "Lavish Editor helps agents turn rich HTML artifacts into collaborative human review surfaces. Whenever you are about to give user a complex response that will be easier to understand via a rich / interactive page, consider using Lavish Editor. First generate an interactive HTML artifact according to user request, then run `lavish-axi <html-file>` so the user can visually review it, annotate elements or selected text, queue prompts, and send feedback back through `lavish-axi poll`.";
-var VERSION = "0.1.27";
+var VERSION = "0.1.28";
 async function run(argv) {
   await ensureStateDir();
   const normalizedArgv = normalizeArgv(argv);
@@ -2195,11 +2219,11 @@ async function endCommand(args) {
 }
 async function stopCommand(args) {
   const port = Number(flagValue(args, "--port") || defaultPort());
-  const baseUrl = `http://${LOOPBACK_HOST}:${port}`;
+  const baseUrl = `http://${hostForUrl(clientHost())}:${port}`;
   return shutdownServerOnPort(port, { baseUrl, currentVersion: VERSION });
 }
 async function shutdownServerOnPort(port, {
-  baseUrl = `http://${LOOPBACK_HOST}:${port}`,
+  baseUrl = `http://${hostForUrl(clientHost())}:${port}`,
   currentVersion = VERSION,
   fetchHealth: healthFetcher = fetchHealth,
   requestShutdown: shutdownRequester = requestShutdown,
@@ -2279,7 +2303,7 @@ function isHtmlPath(file) {
 }
 async function ensureServer({ forceRestart = false } = {}) {
   const port = defaultPort();
-  const baseUrl = `http://${LOOPBACK_HOST}:${port}`;
+  const baseUrl = `http://${hostForUrl(clientHost())}:${port}`;
   const existing = await fetchHealth(baseUrl);
   if (existing && !shouldRestartServer(VERSION, existing, forceRestart)) {
     return baseUrl;
@@ -2543,6 +2567,8 @@ Install or repair agent SessionStart hooks for lavish-axi ambient context in Cla
   server: `Usage: lavish-axi server [--port 4387] [--verbose]
 
 Run the local Lavish Editor server. Pass --verbose (or set LAVISH_AXI_DEBUG=1) to log session and watcher events to stderr. Detached server output is appended to ~/.lavish-axi/server.log, or LAVISH_AXI_STATE_DIR/server.log when set, for startup and crash diagnostics.
+
+LAVISH_AXI_HOST sets the bind address (default 127.0.0.1; a wildcard 0.0.0.0 or :: binds every interface). Binding beyond loopback exposes an unauthenticated server that can read and serve arbitrary local files to anything that can reach it, so only do so on a trusted network. LAVISH_AXI_LINK_HOST sets the hostname written into generated session links (default: the bind address, or loopback when bound to a wildcard). LAVISH_AXI_NO_OPEN=1 (or --no-open) suppresses the local browser launch.
 `
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lavish-axi",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "packageManager": "pnpm@11.1.1",
   "description": "HTML is the new markdown. Lavish is the new editor for your HTML artifacts.",
   "type": "module",

package/skills/lavish/SKILL.md

@@ -2,6 +2,11 @@
 name: lavish
 description: Turn complex or visual agent responses into rich, reviewable HTML artifacts the user can annotate and send feedback on, using the lavish-axi CLI. Use when about to give a plan, comparison, diagram, table, code diff, report, or anything easier to grasp visually than as prose.
 argument-hint: <what the artifact should show>
+author: Kun Chen (kunchenguid)
+metadata:
+  hermes:
+    tags: [html, review, artifacts, visualization]
+    category: productivity
 ---
 
 # Lavish Editor