loadout-ai 0.4.0 → 0.5.0

package/dist/src/core/demo.js

@@ -1,136 +0,0 @@
-import { mkdtemp, readFile, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join, resolve, sep } from "node:path";
-import { buildSkillPlan, applySkillInstall } from "./install.js";
-import { loadEffectiveCatalog } from "./catalog.js";
-import { agentSkillsDirectory } from "./paths.js";
-import { fetchRepositorySnapshot } from "./source.js";
-import { readInstallState } from "./state.js";
-import { restoreSnapshot } from "./snapshot.js";
-import { withMutationLock } from "./transaction.js";
-const DEFAULT_REPOSITORY = "obra/superpowers";
-const DEFAULT_PACKAGE_ID = "obra-superpowers";
-function isWithin(root, path) {
-    const resolvedRoot = resolve(root);
-    const resolvedPath = resolve(path);
-    return (resolvedPath === resolvedRoot ||
-        resolvedPath.startsWith(`${resolvedRoot}${sep}`));
-}
-/**
- * Run a real install and rollback inside a disposable profile. This function
- * deliberately creates virtual agent targets instead of detecting local
- * binaries: the demo proves the installer while never treating a user's real
- * Codex, Claude, or other agent profile as a demo target.
- */
-export async function runIsolatedDemo(options = {}) {
-    if (options.source && options.repository)
-        throw new Error("Demo accepts either a local source or a repository, not both");
-    const profile = await mkdtemp(join(tmpdir(), "loadout-demo-"));
-    const demoLoadoutHome = join(profile, ".loadout");
-    const packageId = options.packageId ?? DEFAULT_PACKAGE_ID;
-    const agentIds = options.agents?.length
-        ? options.agents
-        : ["codex"];
-    const previousUserHome = process.env.LOADOUT_USER_HOME;
-    const previousLoadoutHome = process.env.LOADOUT_HOME;
-    let completed = false;
-    process.env.LOADOUT_USER_HOME = profile;
-    process.env.LOADOUT_HOME = demoLoadoutHome;
-    try {
-        const requestedRepository = options.repository ?? DEFAULT_REPOSITORY;
-        const catalog = options.source
-            ? []
-            : (options.catalog ?? (await loadEffectiveCatalog()));
-        const reviewedPackage = catalog.find((pkg) => pkg.repository.toLowerCase() === requestedRepository.toLowerCase() &&
-            Boolean(pkg.source?.commit));
-        if (!options.source && !options.repository && !reviewedPackage)
-            throw new Error(`The default demo repository ${DEFAULT_REPOSITORY} is missing its reviewed catalog commit`);
-        const fetched = options.source
-            ? undefined
-            : await (options.fetchSnapshot ?? fetchRepositorySnapshot)(requestedRepository, reviewedPackage?.source?.commit
-                ? { ref: reviewedPackage.source.commit }
-                : undefined);
-        if (reviewedPackage?.source?.commit &&
-            fetched.commit.toLowerCase() !==
-                reviewedPackage.source.commit.toLowerCase())
-            throw new Error(`Demo resolved ${fetched.commit}, expected reviewed commit ${reviewedPackage.source.commit}`);
-        const source = options.source ?? fetched.path;
-        const repository = fetched?.repository ?? `local source: ${resolve(source)}`;
-        const targets = agentIds.map((id) => ({
-            id,
-            displayName: `${id} (isolated demo target)`,
-            installed: true,
-            skillsDirectory: agentSkillsDirectory(id, profile),
-        }));
-        const plan = await buildSkillPlan(source, packageId, targets);
-        if (plan.files.some((file) => !isWithin(profile, file.target))) {
-            throw new Error("Demo safety check failed: a planned target escaped the isolated profile");
-        }
-        const snapshotId = await applySkillInstall(plan, fetched
-            ? { repository: fetched.repository, resolvedCommit: fetched.commit }
-            : undefined);
-        const state = await readInstallState();
-        const record = state.installs.find((item) => item.packageId === packageId && item.snapshotId === snapshotId);
-        if (!record)
-            throw new Error("Demo safety check failed: the isolated install was not recorded");
-        if (record.files.some((file) => !isWithin(profile, file.path))) {
-            throw new Error("Demo safety check failed: managed state escaped the isolated profile");
-        }
-        let rolledBack = false;
-        if (!options.keep) {
-            const snapshotPath = join(demoLoadoutHome, "snapshots", `${snapshotId}.json`);
-            const snapshot = JSON.parse(await readFile(snapshotPath, "utf8"));
-            await withMutationLock(() => restoreSnapshot(snapshot));
-            rolledBack = true;
-        }
-        completed = true;
-        return {
-            profile,
-            loadoutHome: demoLoadoutHome,
-            packageId,
-            repository,
-            resolvedCommit: fetched?.commit,
-            reviewed: Boolean(reviewedPackage),
-            targetAgents: agentIds,
-            plannedFiles: plan.files.length,
-            installedFiles: record.files.length,
-            snapshotId,
-            rolledBack,
-            cleanedUp: !options.keep,
-        };
-    }
-    finally {
-        if (previousUserHome === undefined)
-            delete process.env.LOADOUT_USER_HOME;
-        else
-            process.env.LOADOUT_USER_HOME = previousUserHome;
-        if (previousLoadoutHome === undefined)
-            delete process.env.LOADOUT_HOME;
-        else
-            process.env.LOADOUT_HOME = previousLoadoutHome;
-        // The default mode has completed its rollback before removal. On an error
-        // we also remove the partial profile; source repositories are never deleted.
-        if (!options.keep || !completed)
-            await rm(profile, { recursive: true, force: true });
-    }
-}
-export function formatDemoResult(result) {
-    const source = result.resolvedCommit
-        ? `${result.repository} @ ${result.resolvedCommit}`
-        : result.repository;
-    const ending = result.rolledBack
-        ? "Rollback verified and the temporary profile was removed."
-        : `Isolated profile retained at ${result.profile}. Delete it when finished.`;
-    return [
-        "Loadout safe demo complete.",
-        `${result.reviewed ? "Reviewed source" : "Source"}: ${source}`,
-        `Virtual targets: ${result.targetAgents.join(", ")}`,
-        `Installed ${result.plannedFiles} planned skill directory(ies); tracking ${result.installedFiles} file(s).`,
-        `Snapshot: ${result.snapshotId}`,
-        ending,
-    ].join("\n");
-}
-export const demoDefaults = {
-    repository: DEFAULT_REPOSITORY,
-    packageId: DEFAULT_PACKAGE_ID,
-};

package/dist/src/dashboard.js

@@ -1,421 +0,0 @@
-import { createServer, } from "node:http";
-import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
-import { detectAgents } from "./core/paths.js";
-import { inspectAgents } from "./core/agent-inspection.js";
-import { loadEffectiveCatalog, rankCatalog } from "./core/catalog.js";
-import { buildUpdatePlan } from "./core/update.js";
-import { buildHealthReport } from "./core/health.js";
-import { recommendPackages, RECOMMENDATION_BOUNDARY, scanProject, TESTED_PROFILES, } from "./core/recommend.js";
-import { searchLocalRegistry } from "./core/registry.js";
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import { applySyncPlan, buildSyncPlan } from "./core/sync.js";
-import { withMutationLock } from "./core/transaction.js";
-import { readSnapshot, restoreSnapshot } from "./core/snapshot.js";
-import { readInstallState } from "./core/state.js";
-import { adapterCapabilities } from "./core/adapters.js";
-function dashboardDirectory() {
-    if (process.env.LOADOUT_DASHBOARD_DIR)
-        return process.env.LOADOUT_DASHBOARD_DIR;
-    const moduleDirectory = dirname(fileURLToPath(import.meta.url));
-    const candidates = [
-        join(moduleDirectory, "..", "dashboard"),
-        join(moduleDirectory, "..", "..", "dashboard"),
-        join(process.cwd(), "dashboard"),
-    ];
-    return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
-}
-const publicDirectory = dashboardDirectory();
-async function sendJson(response, status, body) {
-    response.writeHead(status, {
-        "content-type": "application/json; charset=utf-8",
-        "cache-control": "no-store",
-        "x-content-type-options": "nosniff",
-        "content-security-policy": "default-src 'none'; frame-ancestors 'none'",
-    });
-    response.end(JSON.stringify(body));
-}
-function safeSyncPlan(plan) {
-    return {
-        manifest: plan.manifest,
-        packages: plan.packages.map((entry) => ({
-            packageId: entry.plan.packageId,
-            targetAgents: entry.plan.targetAgents,
-            files: entry.plan.files.map((file) => ({
-                target: file.target,
-                componentType: file.componentType,
-                compatibility: file.compatibility,
-            })),
-            warnings: entry.plan.warnings,
-            safety: entry.safety,
-        })),
-        mcpChanges: plan.mcpPlans.map((entry) => ({
-            packageId: entry.packageId,
-            path: entry.plan.path,
-            changes: entry.plan.changes,
-            warnings: entry.plan.warnings,
-        })),
-        skipped: plan.skipped,
-        policyViolations: plan.policyViolations,
-    };
-}
-function authorized(request, token) {
-    const provided = request.headers["x-loadout-token"];
-    if (typeof provided !== "string")
-        return false;
-    const a = Buffer.from(provided);
-    const b = Buffer.from(token);
-    return a.length === b.length && timingSafeEqual(a, b);
-}
-function isLoopbackPeer(request) {
-    const address = request.socket.remoteAddress;
-    return (address === "127.0.0.1" ||
-        address === "::1" ||
-        address === "::ffff:127.0.0.1");
-}
-async function body(request) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of request) {
-        const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += value.length;
-        if (size > 8_192)
-            throw new Error("Request body is too large");
-        chunks.push(value);
-    }
-    if (!chunks.length)
-        return {};
-    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-        throw new Error("Request body must be a JSON object");
-    return parsed;
-}
-async function installedPayload() {
-    const [state, agents, catalog] = await Promise.all([
-        readInstallState(),
-        detectAgents(),
-        loadEffectiveCatalog(),
-    ]);
-    const catalogById = new Map(catalog.map((entry) => [entry.id, entry]));
-    const agentById = new Map(agents.map((agent) => [agent.id, agent]));
-    const packages = state.installs
-        .map((entry) => {
-        const catalogEntry = catalogById.get(entry.packageId);
-        return {
-            packageId: entry.packageId,
-            displayName: catalogEntry?.displayName ?? entry.packageId,
-            repository: entry.repository ?? catalogEntry?.repository,
-            resolvedCommit: entry.resolvedCommit,
-            installedAt: entry.installedAt,
-            snapshotId: entry.snapshotId,
-            fileCount: entry.files.length,
-            targetAgents: entry.targetAgents.map((agentId) => {
-                const agent = agentById.get(agentId);
-                return {
-                    id: agentId,
-                    displayName: agent?.displayName ?? agentId,
-                    detected: agent?.installed ?? false,
-                    skillCompatibility: adapterCapabilities(agentId).components.skill,
-                };
-            }),
-        };
-    })
-        .sort((a, b) => b.installedAt.localeCompare(a.installedAt));
-    const lastKnownGoodSnapshot = packages[0]?.snapshotId;
-    return {
-        generatedAt: new Date().toISOString(),
-        platform: process.platform,
-        packages,
-        mcpServers: (state.mcpInstalls ?? []).map((entry) => ({
-            packageId: entry.packageId,
-            serverName: entry.serverName,
-            configPath: entry.configPath,
-            snapshotId: entry.snapshotId,
-            installedAt: entry.installedAt,
-        })),
-        lastKnownGoodSnapshot,
-    };
-}
-function operationPayload(operation) {
-    return operation ?? { status: "idle" };
-}
-async function route(request, response, context) {
-    const pathname = new URL(request.url ?? "/", "http://localhost").pathname;
-    try {
-        // Host headers are attacker-controlled. Check the actual peer too so an
-        // accidentally externally bound server cannot be reached by spoofing
-        // `Host: localhost`.
-        if (!isLoopbackPeer(request)) {
-            await sendJson(response, 403, {
-                error: "Dashboard accepts loopback peers only",
-            });
-            return;
-        }
-        const host = request.headers.host?.split(":")[0];
-        if (host &&
-            host !== "127.0.0.1" &&
-            host !== "localhost" &&
-            host !== "[::1]") {
-            await sendJson(response, 403, {
-                error: "Dashboard accepts loopback hosts only",
-            });
-            return;
-        }
-        if (request.method === "POST" && request.headers.origin) {
-            let sameOrigin = false;
-            try {
-                sameOrigin =
-                    new URL(request.headers.origin).host === request.headers.host;
-            }
-            catch {
-                /* invalid origins are denied */
-            }
-            if (!sameOrigin) {
-                await sendJson(response, 403, {
-                    error: "Cross-origin dashboard mutation denied",
-                });
-                return;
-            }
-        }
-        if (pathname === "/api/session" && request.method === "GET") {
-            await sendJson(response, 200, { token: context.token });
-            return;
-        }
-        if ((pathname === "/api/sync-plan" || pathname === "/api/plan") &&
-            request.method === "GET") {
-            await sendJson(response, 200, {
-                plan: safeSyncPlan(await context.buildSync(context.manifestPath)),
-            });
-            return;
-        }
-        if ((pathname === "/api/sync" || pathname === "/api/apply") &&
-            request.method === "POST") {
-            if (!authorized(request, context.token)) {
-                await sendJson(response, 403, { error: "Invalid dashboard session" });
-                return;
-            }
-            context.operation = {
-                kind: "sync",
-                status: "running",
-                startedAt: new Date().toISOString(),
-            };
-            try {
-                const input = await body(request);
-                const plan = await context.buildSync(context.manifestPath);
-                const result = await context.applySync(plan, context.lockPath, {
-                    approveRisk: input.approveRisk === true,
-                });
-                context.operation = {
-                    ...context.operation,
-                    status: "completed",
-                    finishedAt: new Date().toISOString(),
-                    snapshotId: result.snapshotId,
-                };
-                await sendJson(response, 200, { result });
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                context.operation = {
-                    ...context.operation,
-                    status: "failed",
-                    finishedAt: new Date().toISOString(),
-                    error: message,
-                };
-                throw error;
-            }
-            return;
-        }
-        if (pathname === "/api/rollback" && request.method === "POST") {
-            if (!authorized(request, context.token)) {
-                await sendJson(response, 403, { error: "Invalid dashboard session" });
-                return;
-            }
-            context.operation = {
-                kind: "rollback",
-                status: "running",
-                startedAt: new Date().toISOString(),
-            };
-            try {
-                const input = await body(request);
-                if (typeof input.snapshotId !== "string" ||
-                    !/^[A-Za-z0-9-]+$/.test(input.snapshotId))
-                    throw new Error("A valid snapshotId is required");
-                await context.rollback(input.snapshotId);
-                context.operation = {
-                    ...context.operation,
-                    status: "completed",
-                    finishedAt: new Date().toISOString(),
-                    snapshotId: input.snapshotId,
-                };
-                await sendJson(response, 200, { restored: input.snapshotId });
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                context.operation = {
-                    ...context.operation,
-                    status: "failed",
-                    finishedAt: new Date().toISOString(),
-                    error: message,
-                };
-                throw error;
-            }
-            return;
-        }
-        if (pathname.startsWith("/api/") && request.method !== "GET") {
-            await sendJson(response, 405, { error: "Method not allowed" });
-            return;
-        }
-        if (pathname === "/api/status") {
-            const agents = await detectAgents();
-            await sendJson(response, 200, {
-                agents,
-                inventory: await inspectAgents(agents),
-                platform: process.platform,
-            });
-            return;
-        }
-        if (pathname === "/api/catalog") {
-            const catalog = rankCatalog(await loadEffectiveCatalog());
-            await sendJson(response, 200, { packages: catalog });
-            return;
-        }
-        if (pathname.startsWith("/api/catalog/")) {
-            const id = decodeURIComponent(pathname.slice("/api/catalog/".length));
-            if (!/^[a-z0-9][a-z0-9._-]*$/i.test(id)) {
-                await sendJson(response, 404, { error: "Package not found" });
-                return;
-            }
-            const catalog = await loadEffectiveCatalog();
-            const entry = catalog.find((item) => item.id === id);
-            if (!entry) {
-                await sendJson(response, 404, { error: "Package not found" });
-                return;
-            }
-            await sendJson(response, 200, { package: entry });
-            return;
-        }
-        if (pathname === "/api/installed") {
-            await sendJson(response, 200, await installedPayload());
-            return;
-        }
-        if (pathname === "/api/progress") {
-            await sendJson(response, 200, {
-                operation: operationPayload(context.operation),
-            });
-            return;
-        }
-        if (pathname === "/api/health") {
-            await sendJson(response, 200, { health: await buildHealthReport() });
-            return;
-        }
-        if (pathname === "/api/profiles") {
-            await sendJson(response, 200, { profiles: TESTED_PROFILES });
-            return;
-        }
-        if (pathname === "/api/recommendations") {
-            const signals = await scanProject(process.cwd());
-            await sendJson(response, 200, {
-                signals,
-                recommendationBoundary: RECOMMENDATION_BOUNDARY,
-                recommendations: recommendPackages(signals, await loadEffectiveCatalog()),
-            });
-            return;
-        }
-        if (pathname === "/api/registry") {
-            await sendJson(response, 200, { packages: await searchLocalRegistry() });
-            return;
-        }
-        if (pathname === "/api/update" || pathname === "/api/updates") {
-            const updates = await buildUpdatePlan();
-            await sendJson(response, 200, { updates });
-            return;
-        }
-        const asset = pathname === "/" ? "index.html" : pathname.slice(1);
-        if (request.method !== "GET") {
-            await sendJson(response, 405, { error: "Method not allowed" });
-            return;
-        }
-        if (!/^[a-z0-9._-]+$/i.test(asset)) {
-            await sendJson(response, 404, { error: "Not found" });
-            return;
-        }
-        const content = await readFile(join(publicDirectory, asset));
-        const type = asset.endsWith(".css")
-            ? "text/css; charset=utf-8"
-            : asset.endsWith(".js")
-                ? "text/javascript; charset=utf-8"
-                : "text/html; charset=utf-8";
-        response.writeHead(200, {
-            "content-type": type,
-            "cache-control": "no-store",
-            "x-content-type-options": "nosniff",
-            "x-frame-options": "DENY",
-            "content-security-policy": "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'",
-        });
-        response.end(content);
-    }
-    catch (error) {
-        await sendJson(response, 500, {
-            error: error instanceof Error ? error.message : String(error),
-        });
-    }
-}
-export function createDashboardServer(options = {}) {
-    const context = {
-        manifestPath: options.manifestPath ?? join(process.cwd(), "loadout.json"),
-        lockPath: options.lockPath ?? join(process.cwd(), "loadout.lock"),
-        buildSync: options.buildSync ?? buildSyncPlan,
-        applySync: options.applySync ?? applySyncPlan,
-        rollback: options.rollback ??
-            (async (snapshotId) => withMutationLock(async () => restoreSnapshot(await readSnapshot(snapshotId), {
-                requireUnchangedPostMutationState: true,
-            }))),
-        token: randomBytes(32).toString("hex"),
-    };
-    return createServer((request, response) => {
-        void route(request, response, context);
-    });
-}
-/** Start the dashboard only on loopback. Port zero requests an OS-assigned ephemeral port. */
-export async function startDashboardServer(options = {}, port = 0) {
-    if (!Number.isInteger(port) || port < 0 || port > 65_535)
-        throw new Error("Dashboard port must be an integer between 0 and 65535");
-    const server = createDashboardServer(options);
-    await new Promise((resolve, reject) => {
-        const onError = (error) => {
-            server.off("listening", onListening);
-            reject(error);
-        };
-        const onListening = () => {
-            server.off("error", onError);
-            resolve();
-        };
-        server.once("error", onError);
-        server.once("listening", onListening);
-        server.listen(port, "127.0.0.1");
-    });
-    const address = server.address();
-    if (!address || typeof address === "string") {
-        await new Promise((resolve) => server.close(() => resolve()));
-        throw new Error("Could not determine dashboard address");
-    }
-    return {
-        server,
-        host: "127.0.0.1",
-        port: address.port,
-        close: () => new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve()))),
-    };
-}
-if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
-    const port = process.env.LOADOUT_PORT === undefined
-        ? 0
-        : Number(process.env.LOADOUT_PORT);
-    void startDashboardServer({}, port)
-        .then((handle) => console.log(`Loadout dashboard: http://127.0.0.1:${handle.port}`))
-        .catch((error) => {
-        console.error(error instanceof Error ? error.message : String(error));
-        process.exitCode = 1;
-    });
-}