mango-cms 0.3.34 → 0.3.35

package/lib/vibe-orchestrator/scripts/path-guard-hook.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+// path-guard-hook.mjs
+//
+// PreToolUse hook (HAP-1124, protection #1). Wired into every headless claude
+// run via `--settings` (see claudeRunner.js) so it is enforced SERVER-SIDE,
+// independent of the prompt. Claude invokes this before each Edit/Write/
+// MultiEdit/NotebookEdit with a JSON payload on stdin:
+//
+//   { cwd, tool_name, tool_input: { file_path | notebook_path, ... } }
+//
+// We resolve the target to a repo-root-relative path and, if it hits the
+// protected denylist (or escapes the staging clone), block the tool by exiting
+// with code 2 — the documented PreToolUse "deny" signal: the tool call is
+// stopped and stderr is fed back to Claude as the reason, which it relays to the
+// owner in the drawer. Anything else exits 0 (allow). The hook is fail-safe:
+// any internal error allows the edit rather than wedging the agent, because the
+// post-run git auto-commit + rollback (protection #2) is the backstop.
+
+import path from 'node:path'
+import { isProtectedPath, PROTECTED_MESSAGE } from '../src/pathGuard.js'
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let raw = ''
+    process.stdin.setEncoding('utf8')
+    process.stdin.on('data', (c) => { raw += c })
+    process.stdin.on('end', () => resolve(raw))
+    process.stdin.on('error', () => resolve(raw))
+  })
+}
+
+/** Collect every filesystem path a tool_input may target. */
+function targetPaths(toolInput) {
+  if (!toolInput || typeof toolInput !== 'object') return []
+  const out = []
+  for (const key of ['file_path', 'notebook_path', 'path']) {
+    if (typeof toolInput[key] === 'string' && toolInput[key]) out.push(toolInput[key])
+  }
+  return out
+}
+
+/** Map an absolute-or-relative tool path to a clone-root-relative POSIX path. */
+function toRel(cwd, p) {
+  const abs = path.isAbsolute(p) ? p : path.resolve(cwd || process.cwd(), p)
+  return path.relative(cwd || process.cwd(), abs)
+}
+
+async function main() {
+  let payload = {}
+  try { payload = JSON.parse((await readStdin()) || '{}') } catch { payload = {} }
+
+  const cwd = payload.cwd || process.cwd()
+  const toolInput = payload.tool_input || payload.toolInput || {}
+
+  for (const raw of targetPaths(toolInput)) {
+    const rel = toRel(cwd, raw)
+    // An edit that resolves outside the staging clone is never legitimate.
+    const escapes = rel.startsWith('..') || path.isAbsolute(rel)
+    if (escapes || isProtectedPath(rel)) {
+      process.stderr.write(
+        `${PROTECTED_MESSAGE} (${escapes ? 'outside the staging clone' : rel})`,
+      )
+      process.exit(2) // PreToolUse: block the tool, reason → Claude
+    }
+  }
+
+  process.exit(0) // allow
+}
+
+main().catch(() => process.exit(0)) // fail-open: rollback is the backstop

package/lib/vibe-orchestrator/scripts/vibe-recover.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# vibe-recover.sh — one-command rollback for the Vibe staging clone (HAP-1124).
+#
+# A recovery path usable WITHOUT an engineer. Operates directly on the staging
+# clone's git, so it works even if the orchestrator process is down.
+#
+#   vibe-recover.sh status            # show baseline + recent vibe edits
+#   vibe-recover.sh revert-last       # undo the most recent vibe edit (git revert)
+#   vibe-recover.sh reset-baseline    # hard-reset to the known-good baseline
+#
+# Env (override as needed):
+#   VIBE_STAGING_ROOT  (default /root/Staging)
+#   VIBE_SITE          (default generations-vibe)
+#   VIBE_BASELINE_TAG  (default vibe-baseline)
+set -euo pipefail
+
+ROOT="${VIBE_STAGING_ROOT:-/root/Staging}"
+SITE="${VIBE_SITE:-generations-vibe}"
+TAG="${VIBE_BASELINE_TAG:-vibe-baseline}"
+SETTINGS="mango/config/settings.json"
+DIR="$ROOT/$SITE"
+CMD="${1:-status}"
+
+cd "$DIR" || { echo "staging clone not found: $DIR" >&2; exit 1; }
+
+case "$CMD" in
+  status)
+    echo "site:     $SITE ($DIR)"
+    echo "HEAD:     $(git rev-parse --short HEAD 2>/dev/null || echo '(none)')"
+    if git rev-parse --verify --quiet "${TAG}^{commit}" >/dev/null; then
+      echo "baseline: $TAG -> $(git rev-parse --short "$TAG")"
+    else
+      echo "baseline: (none yet — created on first vibe edit)"
+    fi
+    echo "recent vibe edits:"
+    git log -n 10 --pretty=format:'  %h  %cs  %s' | grep -E '  vibe:' || echo "  (none)"
+    echo
+    ;;
+
+  revert-last)
+    last_msg="$(git log -1 --pretty=format:'%s')"
+    case "$last_msg" in
+      vibe:*) ;;
+      *) echo "the most recent commit is not a vibe edit — nothing to revert" >&2; exit 1 ;;
+    esac
+    git revert --no-edit HEAD
+    echo "reverted last vibe edit; HEAD is now $(git rev-parse --short HEAD)"
+    ;;
+
+  reset-baseline)
+    if ! git rev-parse --verify --quiet "${TAG}^{commit}" >/dev/null; then
+      echo "no baseline tag ($TAG) to reset to" >&2; exit 1
+    fi
+    git reset --hard "$TAG"
+    git clean -fd -e "$SETTINGS"
+    echo "reset clone to baseline $TAG ($(git rev-parse --short "$TAG"))"
+    ;;
+
+  *)
+    echo "usage: vibe-recover.sh {status|revert-last|reset-baseline}" >&2
+    exit 2
+    ;;
+esac

package/lib/vibe-orchestrator/server.js

@@ -0,0 +1,344 @@
+// server.js
+//
+// Orchestrator HTTP entrypoint. Dependency-free (node:http). Exposes:
+//
+//   GET  /health           -> { ok, canRunLive, config summary }
+//   GET  /sessions         -> [ { site, sessionId, cumulativeTokens, status } ]
+//   POST /prompt           -> SSE stream of progress events  body: { site, prompt, pageContext?, attachments? }
+//   POST /abort            -> { ok }                          body: { site }
+//   POST /reset            -> { ok }                          body: { site }
+//   POST /publish          -> { ... }                         body: { site, confirm }
+//
+// Owner auth (HAP-1109): every endpoint except `GET /health` requires a real
+// per-owner token in `Authorization: Bearer <token>`. The token is minted by
+// Mango from an authenticated admin session and verified here against the shared
+// VIBE_ORCH_TOKEN_SECRET (see src/ownerToken.js). Without that secret the server
+// fails CLOSED — gated endpoints return 503, never open access. Client-side role
+// flags are never trusted. The Claude OAuth token is never exposed by any
+// endpoint. Intended to listen on localhost only and be fronted by the staging
+// nginx vhost (see README).
+
+import http from 'node:http'
+import { SessionManager } from './src/sessionManager.js'
+import { config, canRunLive } from './src/config.js'
+import { verifyOwnerToken } from './src/ownerToken.js'
+import * as publisher from './src/publisher.js'
+import * as recovery from './src/recovery.js'
+import { readCosts, rollup } from './src/costStore.js'
+
+const manager = new SessionManager()
+
+/** Extract the bearer token from the Authorization header. */
+function bearer(req) {
+  const h = req.headers['authorization'] || ''
+  const m = /^Bearer\s+(.+)$/i.exec(h.trim())
+  return m ? m[1].trim() : ''
+}
+
+/**
+ * Resolve owner auth for a request. Returns the verifyOwnerToken result:
+ * { ok:true, payload } or { ok:false, reason, status }. Fails closed when no
+ * token secret is configured (status 503).
+ */
+function requireOwner(req) {
+  return verifyOwnerToken(bearer(req), {
+    secret: config.tokenSecret,
+    ownerRoles: config.ownerRoles,
+  })
+}
+
+function sendJson(res, status, body) {
+  const data = JSON.stringify(body)
+  res.writeHead(status, { 'content-type': 'application/json' })
+  res.end(data)
+}
+
+/**
+ * Apply CORS headers for an allowed browser origin (HAP-1121). The ⌘K drawer is
+ * served from the site origin (e.g. https://staging-vibe.generations.org) and
+ * calls this orchestrator on the -api origin cross-origin. Without an allow-list
+ * + preflight handling the browser blocks every call and the drawer shows
+ * "Failed to fetch" (a transport failure with no HTTP status). Headers are set
+ * with setHeader so they merge into later writeHead() calls (JSON + SSE alike).
+ * Returns true when the request Origin is allowed.
+ */
+function applyCors(req, res) {
+  const origin = req.headers['origin']
+  if (!origin) return false
+  const list = config.allowedOrigins
+  const allowed = list.length === 0 || list.includes(origin)
+  if (!allowed) return false
+  res.setHeader('Access-Control-Allow-Origin', origin)
+  res.setHeader('Vary', 'Origin')
+  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
+  res.setHeader('Access-Control-Allow-Headers', 'authorization, content-type')
+  res.setHeader('Access-Control-Max-Age', '86400')
+  return true
+}
+
+/**
+ * Resolve a { from, to } ms window from query params (HAP-1123). Each of `from`
+ * and `to` may be epoch-ms or an ISO date (YYYY-MM-DD). With neither present we
+ * default to the current calendar month-to-date so a bare `/costs/rollup` answers
+ * "this month's spend". An ISO date with no time is treated as UTC midnight.
+ */
+function parseRange(params) {
+  const parse = (v) => {
+    if (!v) return undefined
+    if (/^\d+$/.test(v)) return Number.parseInt(v, 10)
+    const t = Date.parse(v)
+    return Number.isNaN(t) ? undefined : t
+  }
+  let from = parse(params.get('from'))
+  let to = parse(params.get('to'))
+  if (from === undefined && to === undefined) {
+    const now = new Date()
+    from = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1)
+  }
+  return { from, to }
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let raw = ''
+    req.on('data', (c) => {
+      raw += c
+      // 80MB ceiling: prompt bodies may carry a base64 viewport screenshot
+      // (HAP-1111) plus up to 5 user attachments of ≤10MB each (HAP-1126). The
+      // per-file size/mime/count guard runs again server-side in attachments.js;
+      // this is just the gross transport cap.
+      if (raw.length > 80_000_000) reject(new Error('body too large'))
+    })
+    req.on('end', () => {
+      if (!raw) return resolve({})
+      try { resolve(JSON.parse(raw)) } catch { reject(new Error('invalid JSON body')) }
+    })
+    req.on('error', reject)
+  })
+}
+
+function startSse(res, { onPing } = {}) {
+  res.writeHead(200, {
+    'content-type': 'text/event-stream',
+    'cache-control': 'no-cache',
+    connection: 'keep-alive',
+    'x-accel-buffering': 'no', // disable nginx proxy buffering
+  })
+  const write = (event, data) => {
+    res.write(`event: ${event}\n`)
+    res.write(`data: ${JSON.stringify(data)}\n\n`)
+  }
+  // keepalive comment ping so idle proxies don't drop the connection. The ping
+  // also counts as session activity (HAP-1110) so an actively-read but idle
+  // session is kept warm rather than reaped mid-read.
+  const ping = setInterval(() => {
+    res.write(': ping\n\n')
+    onPing?.()
+  }, 15000)
+  if (ping.unref) ping.unref()
+  return { write, close: () => clearInterval(ping) }
+}
+
+async function handlePrompt(req, res) {
+  let body
+  try { body = await readBody(req) } catch (e) { return sendJson(res, 400, { error: e.message }) }
+  const { site, prompt, pageContext, attachments } = body
+
+  let handle
+  try {
+    handle = manager.submit(site, prompt, { pageContext, attachments })
+  } catch (e) {
+    return sendJson(res, 400, { error: e.message })
+  }
+
+  // Track this connection as an active reader and keep the session warm on ping.
+  manager.addReader(site)
+  const sse = startSse(res, { onPing: () => manager.touch(site) })
+  sse.write('accepted', { site })
+
+  handle.emitter.on('event', (ev) => sse.write('progress', ev))
+  handle.emitter.on('error', (err) => sse.write('error', { message: err.message }))
+  handle.emitter.on('end', (summary) => {
+    sse.write('end', summary)
+    sse.close()
+    manager.removeReader(site)
+    res.end()
+  })
+
+  // If the client disconnects, abort the run to free the slot.
+  req.on('close', () => {
+    if (!res.writableEnded) {
+      handle.abort()
+      manager.removeReader(site)
+    }
+    sse.close()
+  })
+}
+
+const server = http.createServer(async (req, res) => {
+  const url = new URL(req.url, 'http://localhost')
+  const route = `${req.method} ${url.pathname}`
+
+  // CORS (HAP-1121): set allow-origin headers for an allowed browser origin and
+  // answer the preflight BEFORE the auth gate. Browsers never send the
+  // Authorization header on an OPTIONS preflight, so gating it on auth returned
+  // 401 and the whole cross-origin call failed in-browser as "Failed to fetch".
+  applyCors(req, res)
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204)
+    return res.end()
+  }
+
+  // `GET /health` is the only unauthenticated route: a minimal liveness probe
+  // for ops/nginx that leaks no config. Everything else requires an owner token.
+  if (route === 'GET /health') {
+    return sendJson(res, 200, { ok: true, ownerAuth: !!config.tokenSecret })
+  }
+
+  // Real per-owner gate. 401 = no/invalid token, 403 = valid but not an owner,
+  // 503 = server not configured for owner auth (fails closed).
+  const auth = requireOwner(req)
+  if (!auth.ok) return sendJson(res, auth.status || 401, { error: auth.reason || 'unauthorized' })
+  req.owner = auth.payload
+
+  try {
+    switch (route) {
+      case 'GET /health/details':
+        return sendJson(res, 200, {
+          ok: true,
+          canRunLive: canRunLive(),
+          stagingRoot: config.stagingRoot,
+          allowedSites: config.allowedSites,
+          tokenCap: config.tokenCap,
+          permissionMode: config.permissionMode,
+          publishEnabled: config.publishEnabled,
+          publishRemote: config.publishRemote,
+          settingsPath: config.settingsPath,
+        })
+
+      case 'GET /sessions':
+        return sendJson(res, 200, { sessions: manager.list() })
+
+      // ---- Cost tracking (HAP-1123) ----
+      // GET /costs         — raw per-turn records in a window (for export/audit)
+      // GET /costs/rollup  — summed totals (by day/session/model) to invoice from
+      // Both default to the current calendar month when no range is given, and
+      // accept ?from / ?to as epoch-ms or YYYY-MM-DD, plus an optional ?site.
+      case 'GET /costs': {
+        const range = parseRange(url.searchParams)
+        const site = url.searchParams.get('site') || undefined
+        return sendJson(res, 200, { ...range, site: site || null, records: readCosts({ ...range, site }) })
+      }
+
+      case 'GET /costs/rollup': {
+        const range = parseRange(url.searchParams)
+        const site = url.searchParams.get('site') || undefined
+        return sendJson(res, 200, rollup({ ...range, site }))
+      }
+
+      case 'POST /prompt':
+        return await handlePrompt(req, res)
+
+      case 'GET /publish/diff': {
+        const site = url.searchParams.get('site') || config.allowedSites[0]
+        try {
+          const d = await publisher.diff(site)
+          return sendJson(res, 200, d)
+        } catch (e) {
+          return sendJson(res, e.statusCode || 400, { error: e.message })
+        }
+      }
+
+      case 'POST /publish': {
+        let body
+        try { body = await readBody(req) } catch (e) { return sendJson(res, 400, { error: e.message }) }
+        const { site, message, confirm } = body
+        try {
+          const result = await publisher.publish(site || config.allowedSites[0], { message, confirm })
+          return sendJson(res, 200, result)
+        } catch (e) {
+          // 409 ⇒ merge conflict publishing the branch into the deploy branch;
+          // surface the conflicting files so the owner can resolve them.
+          return sendJson(res, e.statusCode || 500, {
+            error: e.message,
+            steps: e.steps,
+            conflicts: e.conflicts,
+            deployBranch: e.deployBranch,
+          })
+        }
+      }
+
+      // ---- Recovery / rollback (HAP-1124) ----
+      // GET  /recovery/status        — baseline + recent vibe commits + what's available
+      // POST /recovery/revert-last   — undo the most recent vibe edit (git revert)
+      // POST /recovery/reset-baseline— hard-reset to the known-good baseline (confirm:true)
+      // A recovery path usable without an engineer; also wrapped by scripts/vibe-recover.sh.
+      case 'GET /recovery/status': {
+        const site = url.searchParams.get('site') || config.allowedSites[0]
+        try {
+          return sendJson(res, 200, await recovery.status(site))
+        } catch (e) {
+          return sendJson(res, e.statusCode || 400, { error: e.message })
+        }
+      }
+
+      case 'POST /recovery/revert-last': {
+        const { site } = await readBody(req)
+        const target = site || config.allowedSites[0]
+        if (manager.get(target)?.status === 'running') {
+          return sendJson(res, 409, { error: 'cannot recover while a run is in progress' })
+        }
+        try {
+          return sendJson(res, 200, await recovery.revertLast(target))
+        } catch (e) {
+          return sendJson(res, e.statusCode || 400, { error: e.message })
+        }
+      }
+
+      case 'POST /recovery/reset-baseline': {
+        const { site, confirm } = await readBody(req)
+        const target = site || config.allowedSites[0]
+        if (confirm !== true) {
+          return sendJson(res, 400, { error: 'reset to baseline requires explicit confirm:true' })
+        }
+        if (manager.get(target)?.status === 'running') {
+          return sendJson(res, 409, { error: 'cannot recover while a run is in progress' })
+        }
+        try {
+          return sendJson(res, 200, await recovery.resetToBaseline(target))
+        } catch (e) {
+          return sendJson(res, e.statusCode || 400, { error: e.message })
+        }
+      }
+
+      case 'POST /abort': {
+        const { site } = await readBody(req)
+        manager.abort(site)
+        return sendJson(res, 200, { ok: true })
+      }
+
+      case 'POST /reset': {
+        const { site } = await readBody(req)
+        try { manager.reset(site) } catch (e) { return sendJson(res, 409, { error: e.message }) }
+        return sendJson(res, 200, { ok: true })
+      }
+
+      default:
+        return sendJson(res, 404, { error: 'not found' })
+    }
+  } catch (e) {
+    if (!res.headersSent) sendJson(res, 500, { error: e.message })
+  }
+})
+
+// Listen on loopback only; nginx terminates TLS and proxies.
+server.listen(config.port, '127.0.0.1', () => {
+  // eslint-disable-next-line no-console
+  console.log(`[vibe-orchestrator] listening on 127.0.0.1:${config.port} (live=${canRunLive()}, ownerAuth=${!!config.tokenSecret})`)
+  if (!config.tokenSecret) {
+    // eslint-disable-next-line no-console
+    console.warn('[vibe-orchestrator] WARNING: VIBE_ORCH_TOKEN_SECRET is unset — owner auth is NOT configured; all gated endpoints will return 503 (fail closed).')
+  }
+})
+
+export { server }

package/lib/vibe-orchestrator/src/attachments.js

@@ -0,0 +1,98 @@
+// attachments.js
+//
+// Persist client-uploaded chat attachments (images + PDFs) to temp files the
+// agent can Read — Claude Code natively reads images AND PDFs. Generalizes
+// screenshot.js: each file arrives as a base64 data URL and is written to the OS
+// temp dir, NEVER into the staging repo, so nothing is ever committed or
+// published. Each turn we first clear the site's previous attachments so temp
+// growth stays bounded (the screenshot reuses one fixed file; attachments are a
+// variable-length set, so we sweep the whole `<site>-att-*` prefix). Best-effort
+// — never throws. A server-side size + mime + count guard runs here too so we
+// don't trust the client (HAP-1126).
+
+import { writeFileSync, mkdirSync, readdirSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const DIR = join(tmpdir(), 'vibe-orchestrator')
+
+// Allowed upload types → file extension. Mirrors the client allow-list. The
+// extension is taken from the data URL's own mime (what the bytes actually are),
+// not the caller-supplied name, exactly like screenshot.js.
+const MIME_EXT = {
+  'image/png': 'png',
+  'image/jpeg': 'jpg',
+  'image/webp': 'webp',
+  'image/gif': 'gif',
+  'application/pdf': 'pdf',
+}
+
+const MAX_FILES = 5
+const MAX_BYTES = 10 * 1024 * 1024 // 10MB per file, decoded (server-side guard)
+
+const DATA_URL = /^data:([a-z0-9.+-]+\/[a-z0-9.+-]+);base64,([A-Za-z0-9+/=\s]+)$/i
+
+function safeSite(site) {
+  return String(site || 'site').replace(/[^a-z0-9_-]/gi, '_')
+}
+
+/** Remove any previously-persisted attachments for a site (best-effort). */
+function clearAttachments(site) {
+  const prefix = `${safeSite(site)}-att-`
+  try {
+    for (const f of readdirSync(DIR)) {
+      if (f.startsWith(prefix)) {
+        try { rmSync(join(DIR, f)) } catch { /* already gone */ }
+      }
+    }
+  } catch { /* dir missing — nothing to clear */ }
+}
+
+/**
+ * Persist a list of `{ name, mime, dataUrl }` attachments to disk. Returns an
+ * array of `{ name, path, mime }` for the files that were saved. Invalid entries
+ * (disallowed mime, malformed data URL, empty, or oversize) are skipped, and the
+ * count is capped at MAX_FILES. Passing an array (even empty) clears the site's
+ * previous attachments first, so each turn starts clean. Best-effort — never
+ * throws.
+ *
+ * @param {string} site
+ * @param {Array<{name?:string, mime?:string, dataUrl?:string}>} attachments
+ * @returns {Array<{name:string, path:string, mime:string}>}
+ */
+function persistAttachments(site, attachments) {
+  if (!Array.isArray(attachments)) return []
+  // Per-turn clean: drop the previous turn's files so temp never grows unbounded.
+  clearAttachments(site)
+  if (!attachments.length) return []
+
+  const saved = []
+  try { mkdirSync(DIR, { recursive: true }) } catch { return saved }
+  const safe = safeSite(site)
+  let n = 0
+  for (const att of attachments) {
+    if (n >= MAX_FILES) break
+    if (!att || typeof att !== 'object') continue
+    const dataUrl = typeof att.dataUrl === 'string' ? att.dataUrl.trim() : ''
+    const m = DATA_URL.exec(dataUrl)
+    if (!m) continue
+    const mime = m[1].toLowerCase()
+    const ext = MIME_EXT[mime]
+    if (!ext) continue // disallowed type — skip silently (client already warned)
+    let buf
+    try { buf = Buffer.from(m[2].replace(/\s+/g, ''), 'base64') } catch { continue }
+    if (!buf.length || buf.length > MAX_BYTES) continue // empty or oversize — skip
+    n += 1
+    const path = join(DIR, `${safe}-att-${n}.${ext}`)
+    const name = typeof att.name === 'string' && att.name.trim()
+      ? att.name.trim().slice(0, 200)
+      : `attachment-${n}.${ext}`
+    try {
+      writeFileSync(path, buf)
+      saved.push({ name, path, mime })
+    } catch { /* write failed — skip this one */ }
+  }
+  return saved
+}
+
+export { persistAttachments, clearAttachments, MIME_EXT, MAX_FILES, MAX_BYTES }