npm - nebula-notebook - Versions diffs - 0.1.0 - Mend

nebula-notebook 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (97) hide show

package/README.md +222 -0
package/bin/nebula-notebook.js +33 -0
package/dist/assets/index-C1h_sArD.css +32 -0
package/dist/assets/index-CDSTBon8.js +658 -0
package/dist/favicon.svg +11 -0
package/dist/index.html +73 -0
package/node-server/dist/app.d.ts +5 -0
package/node-server/dist/app.js +38 -0
package/node-server/dist/auth/auth-middleware.d.ts +24 -0
package/node-server/dist/auth/auth-middleware.js +276 -0
package/node-server/dist/auth/auth-service.d.ts +84 -0
package/node-server/dist/auth/auth-service.js +265 -0
package/node-server/dist/auth/index.d.ts +3 -0
package/node-server/dist/auth/index.js +8 -0
package/node-server/dist/cluster/client-registration.d.ts +43 -0
package/node-server/dist/cluster/client-registration.js +217 -0
package/node-server/dist/cluster/cluster-secret.d.ts +11 -0
package/node-server/dist/cluster/cluster-secret.js +90 -0
package/node-server/dist/cluster/kernel-proxy.d.ts +100 -0
package/node-server/dist/cluster/kernel-proxy.js +361 -0
package/node-server/dist/cluster/server-registry.d.ts +109 -0
package/node-server/dist/cluster/server-registry.js +217 -0
package/node-server/dist/config/output-limits.d.ts +7 -0
package/node-server/dist/config/output-limits.js +10 -0
package/node-server/dist/discovery/discovery-service.d.ts +198 -0
package/node-server/dist/discovery/discovery-service.js +811 -0
package/node-server/dist/discovery/index.d.ts +5 -0
package/node-server/dist/discovery/index.js +21 -0
package/node-server/dist/discovery/types.d.ts +48 -0
package/node-server/dist/discovery/types.js +24 -0
package/node-server/dist/fs/fs-service.d.ts +218 -0
package/node-server/dist/fs/fs-service.js +1422 -0
package/node-server/dist/fs/index.d.ts +5 -0
package/node-server/dist/fs/index.js +21 -0
package/node-server/dist/fs/types.d.ts +132 -0
package/node-server/dist/fs/types.js +5 -0
package/node-server/dist/index.d.ts +13 -0
package/node-server/dist/index.js +556 -0
package/node-server/dist/kernel/default-kernel.d.ts +5 -0
package/node-server/dist/kernel/default-kernel.js +138 -0
package/node-server/dist/kernel/index.d.ts +7 -0
package/node-server/dist/kernel/index.js +23 -0
package/node-server/dist/kernel/kernel-service.d.ts +290 -0
package/node-server/dist/kernel/kernel-service.js +1714 -0
package/node-server/dist/kernel/kernelspec.d.ts +29 -0
package/node-server/dist/kernel/kernelspec.js +210 -0
package/node-server/dist/kernel/session-store.d.ts +87 -0
package/node-server/dist/kernel/session-store.js +303 -0
package/node-server/dist/kernel/types.d.ts +143 -0
package/node-server/dist/kernel/types.js +17 -0
package/node-server/dist/llm/index.d.ts +5 -0
package/node-server/dist/llm/index.js +21 -0
package/node-server/dist/llm/llm-service.d.ts +77 -0
package/node-server/dist/llm/llm-service.js +454 -0
package/node-server/dist/llm/types.d.ts +40 -0
package/node-server/dist/llm/types.js +15 -0
package/node-server/dist/notebook/cell-metadata.d.ts +27 -0
package/node-server/dist/notebook/cell-metadata.js +76 -0
package/node-server/dist/notebook/headless-handler.d.ts +127 -0
package/node-server/dist/notebook/headless-handler.js +1530 -0
package/node-server/dist/notebook/notebook-websocket.d.ts +12 -0
package/node-server/dist/notebook/notebook-websocket.js +103 -0
package/node-server/dist/notebook/operation-router.d.ts +115 -0
package/node-server/dist/notebook/operation-router.js +641 -0
package/node-server/dist/notebook/undoRedoManager.d.ts +194 -0
package/node-server/dist/notebook/undoRedoManager.js +558 -0
package/node-server/dist/output/display-data.d.ts +14 -0
package/node-server/dist/output/display-data.js +134 -0
package/node-server/dist/resources/resource-service.d.ts +69 -0
package/node-server/dist/resources/resource-service.js +363 -0
package/node-server/dist/routes/auth.d.ts +5 -0
package/node-server/dist/routes/auth.js +61 -0
package/node-server/dist/routes/cluster.d.ts +7 -0
package/node-server/dist/routes/cluster.js +94 -0
package/node-server/dist/routes/fs.d.ts +7 -0
package/node-server/dist/routes/fs.js +392 -0
package/node-server/dist/routes/kernel.d.ts +13 -0
package/node-server/dist/routes/kernel.js +637 -0
package/node-server/dist/routes/llm.d.ts +8 -0
package/node-server/dist/routes/llm.js +105 -0
package/node-server/dist/routes/notebook.d.ts +10 -0
package/node-server/dist/routes/notebook.js +335 -0
package/node-server/dist/routes/python.d.ts +8 -0
package/node-server/dist/routes/python.js +187 -0
package/node-server/dist/routes/resources.d.ts +7 -0
package/node-server/dist/routes/resources.js +77 -0
package/node-server/dist/scripts/show-auth-qr.d.ts +1 -0
package/node-server/dist/scripts/show-auth-qr.js +81 -0
package/node-server/dist/terminal/pty-manager.d.ts +100 -0
package/node-server/dist/terminal/pty-manager.js +246 -0
package/node-server/dist/terminal/server.d.ts +19 -0
package/node-server/dist/terminal/server.js +254 -0
package/node-server/dist/terminal/types.d.ts +50 -0
package/node-server/dist/terminal/types.js +9 -0
package/node-server/package.json +45 -0
package/package.json +99 -0
package/scripts/postinstall.cjs +26 -0

package/dist/favicon.svg ADDED Viewed

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+  <defs>
+    <linearGradient id="nebula" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" style="stop-color:#8b5cf6"/>
+      <stop offset="50%" style="stop-color:#6366f1"/>
+      <stop offset="100%" style="stop-color:#3b82f6"/>
+    </linearGradient>
+  </defs>
+  <rect width="32" height="32" rx="6" fill="url(#nebula)"/>
+  <path d="M8 10h16M8 16h12M8 22h14" stroke="white" stroke-width="2.5" stroke-linecap="round"/>
+</svg>

package/dist/index.html ADDED Viewed

@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" id="favicon" />
+    <title>Nebula Notebook</title>
+    <style>
+      /* Custom scrollbar for a cleaner look */
+      ::-webkit-scrollbar {
+        width: 8px;
+        height: 8px;
+      }
+      ::-webkit-scrollbar-track {
+        background: transparent;
+      }
+      ::-webkit-scrollbar-thumb {
+        background: #cbd5e1;
+        border-radius: 4px;
+      }
+      ::-webkit-scrollbar-thumb:hover {
+        background: #94a3b8;
+      }
+      .cm-editor { font-family: 'Fira Code', monospace; }
+      /* Pandas Dataframe Styling */
+      .dataframe {
+        font-size: 0.85rem;
+        border-collapse: collapse;
+        border: 1px solid #e2e8f0;
+        width: 100%;
+        max-width: 100%;
+        overflow-x: auto;
+        display: block;
+      }
+      .dataframe th {
+        background-color: #f8fafc;
+        font-weight: 600;
+        text-align: left;
+        padding: 0.5rem;
+        border-bottom: 2px solid #e2e8f0;
+        color: #475569;
+      }
+      .dataframe td {
+        padding: 0.5rem;
+        border-bottom: 1px solid #e2e8f0;
+        color: #334155;
+      }
+      .dataframe tr:nth-child(even) {
+        background-color: #fcfcfc;
+      }
+      .dataframe tr:hover {
+        background-color: #f1f5f9;
+      }
+    </style>
+  <script type="importmap">
+{
+  "imports": {
+    "lucide-react": "https://esm.sh/lucide-react@^0.561.0",
+    "react/": "https://esm.sh/react@^19.2.3/",
+    "react": "https://esm.sh/react@^19.2.3",
+    "react-dom/": "https://esm.sh/react-dom@^19.2.3/"
+  }
+}
+</script>
+  <script type="module" crossorigin src="/assets/index-CDSTBon8.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-C1h_sArD.css">
+</head>
+  <body class="bg-slate-50 text-slate-900 antialiased">
+    <div id="root"></div>
+</body>
+</html>

package/node-server/dist/app.d.ts ADDED Viewed

@@ -0,0 +1,5 @@
+/**
+ * Fastify App Setup - Shared middleware and configuration
+ */
+import { FastifyInstance } from 'fastify';
+export declare function createApp(): FastifyInstance;

package/node-server/dist/app.js ADDED Viewed

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Fastify App Setup - Shared middleware and configuration
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApp = createApp;
+const fastify_1 = __importDefault(require("fastify"));
+function createApp() {
+    const bodyLimit = process.env.NEBULA_BODY_LIMIT ||
+        process.env.NEBULA_MAX_BODY_SIZE ||
+        '200mb';
+    const app = (0, fastify_1.default)({
+        bodyLimit: parseBodyLimit(bodyLimit),
+    });
+    return app;
+}
+/**
+ * Parse a human-readable body limit string (e.g., '200mb', '1gb') to bytes.
+ */
+function parseBodyLimit(limit) {
+    const match = limit.match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb|tb)?$/i);
+    if (!match) {
+        return 200 * 1024 * 1024; // default 200mb
+    }
+    const value = parseFloat(match[1]);
+    const unit = (match[2] || 'b').toLowerCase();
+    const multipliers = {
+        b: 1,
+        kb: 1024,
+        mb: 1024 * 1024,
+        gb: 1024 * 1024 * 1024,
+        tb: 1024 * 1024 * 1024 * 1024,
+    };
+    return Math.floor(value * (multipliers[unit] || 1));
+}

package/node-server/dist/auth/auth-middleware.d.ts ADDED Viewed

@@ -0,0 +1,24 @@
+/**
+ * Auth Middleware - Protect routes and WebSocket connections
+ *
+ * Public routes (no auth required):
+ * - /api/health
+ * - /api/ready
+ * - /api/auth/*
+ */
+import { FastifyRequest, FastifyReply } from 'fastify';
+import { IncomingMessage } from 'http';
+/**
+ * Persist a session token to disk so MCP servers and CLI tools
+ * can piggyback on the browser's authentication.
+ */
+export declare function persistSessionToken(token: string): void;
+/**
+ * Fastify onRequest hook for authentication
+ */
+export declare function authMiddleware(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * WebSocket authentication middleware
+ * Returns true if the connection is authenticated
+ */
+export declare function authWebSocketMiddleware(request: IncomingMessage): boolean;

package/node-server/dist/auth/auth-middleware.js ADDED Viewed

@@ -0,0 +1,276 @@
+"use strict";
+/**
+ * Auth Middleware - Protect routes and WebSocket connections
+ *
+ * Public routes (no auth required):
+ * - /api/health
+ * - /api/ready
+ * - /api/auth/*
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.persistSessionToken = persistSessionToken;
+exports.authMiddleware = authMiddleware;
+exports.authWebSocketMiddleware = authWebSocketMiddleware;
+const url_1 = require("url");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const auth_service_1 = require("./auth-service");
+const cluster_secret_1 = require("../cluster/cluster-secret");
+const SESSION_TOKEN_PATH = path.join(os.homedir(), '.nebula', 'session-token');
+/**
+ * Persist a session token to disk so MCP servers and CLI tools
+ * can piggyback on the browser's authentication.
+ */
+function persistSessionToken(token) {
+    try {
+        const dir = path.dirname(SESSION_TOKEN_PATH);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(SESSION_TOKEN_PATH, token, { mode: 0o600 });
+    }
+    catch {
+        // Non-critical — MCP just won't be able to auto-auth
+    }
+}
+/**
+ * Read the persisted session token (written when browser authenticates).
+ */
+function readSessionToken() {
+    try {
+        if (!fs.existsSync(SESSION_TOKEN_PATH))
+            return undefined;
+        const token = fs.readFileSync(SESSION_TOKEN_PATH, 'utf-8').trim();
+        return token || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Routes that don't require authentication
+const PUBLIC_ROUTES = [
+    '/api/health',
+    '/api/ready',
+    '/api/auth/status',
+    '/api/auth/verify',
+];
+const CLUSTER_SECRET_HEADER = 'x-nebula-cluster-secret';
+function isClientMode() {
+    const explicit = process.env.NEBULA_CLIENT_MODE;
+    if (explicit !== undefined) {
+        return explicit === 'true';
+    }
+    return !!process.env.NEBULA_MAIN_SERVER;
+}
+function getClusterSecret() {
+    return process.env.NEBULA_CLUSTER_SECRET || (0, cluster_secret_1.readClusterSecret)() || null;
+}
+/**
+ * Extract auth token from request
+ * Checks Authorization header (Bearer token) and query parameter
+ */
+function extractToken(req) {
+    // Check Authorization header
+    const authHeader = req.headers.authorization;
+    if (authHeader?.startsWith('Bearer ')) {
+        return authHeader.slice(7);
+    }
+    // Check query parameter (for WebSocket and MCP connections)
+    // FastifyRequest has parsed query, IncomingMessage needs URL parsing
+    if ('query' in req && typeof req.query === 'object' && req.query?.token) {
+        return req.query.token;
+    }
+    // Fallback: parse URL manually (for IncomingMessage / WebSocket upgrade)
+    const url = req.url;
+    if (url) {
+        const parsed = (0, url_1.parse)(url, true);
+        const token = parsed.query.token;
+        if (typeof token === 'string') {
+            return token;
+        }
+    }
+    return undefined;
+}
+function extractClusterSecret(req) {
+    const headers = req.headers;
+    const value = headers[CLUSTER_SECRET_HEADER];
+    if (Array.isArray(value)) {
+        return value[0];
+    }
+    return value;
+}
+function hasValidClusterSecret(req) {
+    const clusterSecret = getClusterSecret();
+    if (!clusterSecret) {
+        return false;
+    }
+    const provided = extractClusterSecret(req);
+    return Boolean(provided && provided === clusterSecret);
+}
+function isClusterRoute(pathname) {
+    return pathname.startsWith('/api/servers') || pathname.startsWith('/servers');
+}
+/**
+ * Check if a path is a public route
+ */
+function isPublicRoute(pathname) {
+    // Exact matches
+    if (PUBLIC_ROUTES.includes(pathname)) {
+        return true;
+    }
+    // Static files (frontend assets)
+    if (!pathname.startsWith('/api/')) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Fastify onRequest hook for authentication
+ */
+async function authMiddleware(request, reply) {
+    // Reconstruct the full pathname including the prefix
+    // Fastify strips the prefix when registering under /api, so we need the raw URL
+    const pathname = request.url.split('?')[0];
+    if (isClientMode()) {
+        // Allow public routes regardless
+        if (isPublicRoute(pathname)) {
+            return;
+        }
+        if (!getClusterSecret()) {
+            return reply.code(503).send({
+                error: 'cluster_secret_required',
+                message: 'Cluster secret required for client mode. Set NEBULA_CLUSTER_SECRET.',
+            });
+        }
+        if (!hasValidClusterSecret(request)) {
+            return reply.code(403).send({
+                error: 'cluster_auth_required',
+                message: 'Cluster authentication required.',
+            });
+        }
+        return;
+    }
+    if (isClusterRoute(pathname) && hasValidClusterSecret(request)) {
+        return;
+    }
+    if (auth_service_1.authService.isAuthDisabled()) {
+        return;
+    }
+    // Allow public routes
+    if (isPublicRoute(pathname)) {
+        return;
+    }
+    // Check if auth is configured
+    if (!auth_service_1.authService.isSetupComplete()) {
+        // During setup, only allow auth routes
+        return reply.code(503).send({
+            error: 'setup_required',
+            message: '2FA setup not complete. Check server terminal for QR code.',
+        });
+    }
+    // Extract and validate token
+    let token = extractToken(request);
+    // Fallback: if no token in request, check the persisted session token file.
+    // This allows MCP servers and CLI tools to piggyback on the browser's auth
+    // without needing their own TOTP flow.
+    if (!token) {
+        token = readSessionToken();
+    }
+    if (!token) {
+        return reply.code(401).send({
+            error: 'auth_required',
+            message: 'Authentication required. Please log in.',
+        });
+    }
+    const payload = auth_service_1.authService.validateToken(token);
+    if (!payload) {
+        return reply.code(401).send({
+            error: 'invalid_token',
+            message: 'Invalid or expired token. Please log in again.',
+        });
+    }
+    // Persist valid tokens from request headers so MCP/CLI can piggyback.
+    // Only write once (when file doesn't exist or token differs).
+    const requestToken = extractToken(request);
+    if (requestToken) {
+        const existing = readSessionToken();
+        if (existing !== requestToken) {
+            persistSessionToken(requestToken);
+        }
+    }
+    // Token is valid, continue (simply return)
+}
+/**
+ * WebSocket authentication middleware
+ * Returns true if the connection is authenticated
+ */
+function authWebSocketMiddleware(request) {
+    if (isClientMode()) {
+        const clusterSecret = getClusterSecret();
+        if (!clusterSecret) {
+            console.log('[Auth] WebSocket rejected - cluster secret not configured');
+            return false;
+        }
+        const provided = extractClusterSecret(request);
+        if (provided !== clusterSecret) {
+            console.log('[Auth] WebSocket rejected - invalid cluster secret');
+            return false;
+        }
+        return true;
+    }
+    if (auth_service_1.authService.isAuthDisabled()) {
+        return true;
+    }
+    const url = request.url || '';
+    const pathname = (0, url_1.parse)(url).pathname || '';
+    // Check if auth is configured
+    if (!auth_service_1.authService.isSetupComplete()) {
+        console.log('[Auth] WebSocket rejected - setup not complete');
+        return false;
+    }
+    // Extract and validate token from query parameter
+    const token = extractToken(request);
+    if (!token) {
+        console.log('[Auth] WebSocket rejected - no token provided');
+        return false;
+    }
+    const payload = auth_service_1.authService.validateToken(token);
+    if (!payload) {
+        console.log('[Auth] WebSocket rejected - invalid token');
+        return false;
+    }
+    return true;
+}

package/node-server/dist/auth/auth-service.d.ts ADDED Viewed

@@ -0,0 +1,84 @@
+/**
+ * Auth Service - TOTP-based 2FA authentication
+ *
+ * Handles:
+ * - TOTP secret generation and verification
+ * - JWT session token management
+ * - Auth config persistence (~/.nebula/auth.json)
+ */
+export interface AuthConfig {
+    totpSecret: string;
+    jwtSecret: string;
+    setupComplete: boolean;
+    createdAt: number;
+}
+export interface JWTPayload {
+    iat: number;
+    exp: number;
+    trusted: boolean;
+}
+export interface AuthStatus {
+    configured: boolean;
+    authenticated: boolean;
+}
+export interface VerifyResult {
+    success: boolean;
+    token?: string;
+    error?: string;
+}
+declare class AuthService {
+    private config;
+    private initialized;
+    private failedAttempts;
+    private disabled;
+    /**
+     * Disable authentication (for local/dev usage only)
+     */
+    disableAuth(): void;
+    isAuthDisabled(): boolean;
+    /**
+     * Initialize the auth service
+     * Returns true if setup is needed (first run)
+     */
+    initialize(): Promise<boolean>;
+    /**
+     * Generate a secure random JWT secret
+     */
+    private generateJWTSecret;
+    /**
+     * Save config to disk with secure permissions
+     */
+    private saveConfig;
+    /**
+     * Print QR code and manual key to terminal for initial setup
+     */
+    printSetupInstructions(): void;
+    /**
+     * Check if 2FA setup is complete
+     */
+    isSetupComplete(): boolean;
+    /**
+     * Verify a TOTP code and issue a JWT token
+     */
+    verifyCode(code: string, trustBrowser?: boolean): VerifyResult;
+    /**
+     * Issue a new JWT token
+     */
+    private issueToken;
+    /**
+     * Validate a JWT token
+     * Returns the payload if valid, null if invalid
+     */
+    validateToken(token: string): JWTPayload | null;
+    /**
+     * Get auth status for a request
+     */
+    getAuthStatus(token?: string): AuthStatus;
+    /**
+     * Get the TOTP secret (for testing only)
+     * @internal
+     */
+    _getTotpSecret(): string | null;
+}
+export declare const authService: AuthService;
+export {};