neural-loom 0.2.69 → 0.3.0

package/src/lib/agents/pricing.ts

@@ -0,0 +1,45 @@
+/**
+ * Model-keyed pricing used to estimate session cost when the agent's own output
+ * doesn't report a dollar figure. Rates are USD per token (list price / 1e6).
+ * These are approximate and should be updated as provider pricing changes.
+ */
+export interface ModelRate {
+  input: number;
+  output: number;
+}
+
+const M = 1_000_000;
+
+const MODEL_RATES: Record<string, ModelRate> = {
+  // Anthropic Claude (per 1M tokens: input / output)
+  "claude-opus-4": { input: 15 / M, output: 75 / M },
+  "claude-sonnet-4": { input: 3 / M, output: 15 / M },
+  "claude-haiku-4": { input: 1 / M, output: 5 / M },
+  "claude-3-5-sonnet": { input: 3 / M, output: 15 / M },
+  "claude-3-5-haiku": { input: 0.8 / M, output: 4 / M },
+  "claude-3-opus": { input: 15 / M, output: 75 / M },
+  // OpenAI (for Aider users)
+  "gpt-4o": { input: 2.5 / M, output: 10 / M },
+  "gpt-4o-mini": { input: 0.15 / M, output: 0.6 / M },
+  "gpt-4-turbo": { input: 10 / M, output: 30 / M },
+};
+
+/** Default when the model is unknown — a mid-tier Claude rate. */
+export const DEFAULT_MODEL = "claude-sonnet-4";
+
+export function getModelRate(model?: string): ModelRate {
+  if (model) {
+    const key = model.toLowerCase();
+    if (MODEL_RATES[key]) return MODEL_RATES[key];
+    // Substring match so e.g. "claude-sonnet-4-6" or "anthropic/claude-3-5-sonnet" resolve.
+    for (const k of Object.keys(MODEL_RATES)) {
+      if (key.includes(k)) return MODEL_RATES[k];
+    }
+  }
+  return MODEL_RATES[DEFAULT_MODEL];
+}
+
+export function estimateCost(inputTokens: number, outputTokens: number, model?: string): number {
+  const rate = getModelRate(model);
+  return inputTokens * rate.input + outputTokens * rate.output;
+}

package/src/lib/agents/runtime.ts

@@ -0,0 +1,92 @@
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { getConfigDir } from "../config";
+
+/** Shared runtime helpers used by the PTY-backed runners. */
+
+export function isWindows(): boolean {
+  return typeof process !== "undefined" && process.platform === "win32";
+}
+
+/**
+ * Locate a Git Bash executable. Returns "bash" on non-Windows. On Windows,
+ * probes the usual install locations and returns null if none are found.
+ */
+export function findGitBash(): string | null {
+  if (!isWindows()) {
+    return "bash";
+  }
+  const pf = process.env.PROGRAMFILES || "C:\\Program Files";
+  const pf86 = process.env["PROGRAMFILES(X86)"] || "C:\\Program Files (x86)";
+  const local = process.env.LOCALAPPDATA || "";
+
+  const candidates: string[] = [
+    process.env.WINGMAN_BASH_PATH,
+    path.join(pf, "Git", "bin", "bash.exe"),
+    path.join(pf86, "Git", "bin", "bash.exe"),
+    local ? path.join(local, "Programs", "Git", "bin", "bash.exe") : "",
+  ].filter((p): p is string => typeof p === "string" && p !== "");
+
+  return candidates.find((p) => fs.existsSync(p)) || null;
+}
+
+/**
+ * Like findGitBash, but for an interactive workspace shell: on Windows, falls
+ * back to PowerShell and then cmd.exe when Git Bash is unavailable.
+ */
+export function findInteractiveShell(): string | null {
+  const bash = findGitBash();
+  if (bash) return bash;
+  if (!isWindows()) return null;
+
+  const windir = process.env.windir || "C:\\Windows";
+  const powershell = path.join(windir, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  if (fs.existsSync(powershell)) return powershell;
+
+  const cmd = path.join(windir, "System32", "cmd.exe");
+  if (fs.existsSync(cmd)) return cmd;
+
+  return null;
+}
+
+let cachedPty: typeof import("node-pty") | null = null;
+
+/**
+ * Load node-pty at runtime. Uses an indirected require so the Next/Turbopack
+ * bundler does not try to statically analyse the native module (it is also
+ * declared in serverExternalPackages). Cached after first load.
+ */
+export function loadNodePty(): typeof import("node-pty") {
+  if (!cachedPty) {
+    cachedPty = eval("require")("node-pty") as typeof import("node-pty");
+  }
+  return cachedPty;
+}
+
+/**
+ * Resolve extra CLI flags for the `claude` command. `--resume` when resuming,
+ * otherwise the `extraFlags` field from the user's claude.json (if any).
+ */
+export function loadClaudeExtraFlags(resume?: boolean): string {
+  if (resume) return "--resume";
+  const claudeConfigPath = path.join(getConfigDir(), "claude.json");
+  if (fs.existsSync(claudeConfigPath)) {
+    try {
+      const config = JSON.parse(fs.readFileSync(claudeConfigPath, "utf8"));
+      if (config.extraFlags) return config.extraFlags;
+    } catch (err) {
+      console.error("Failed to parse Claude configuration:", err);
+    }
+  }
+  return "";
+}
+
+/** Build the Windows PATH override (prepends VS Node + global npm). */
+export function windowsPathOverride(): string {
+  const vsNode =
+    "C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\MSBuild\\Microsoft\\VisualStudio\\NodeJs";
+  const localNpm = path.join(os.homedir(), "AppData", "Local", "npm");
+  const existingPath = process.env.Path || process.env.PATH || "";
+  return [vsNode, localNpm, existingPath].filter(Boolean).join(";");
+}

package/src/lib/gitSafe.ts

@@ -0,0 +1,15 @@
+/**
+ * Validate a git ref name before passing it to `git`. Even with execFile (no
+ * shell), a value starting with `-` could be misread as an option, so we reject
+ * those along with git-illegal characters and `..` sequences.
+ */
+export function isValidBranchName(name: unknown): name is string {
+  return (
+    typeof name === "string" &&
+    name.length > 0 &&
+    name.length <= 255 &&
+    !name.startsWith("-") &&
+    !name.includes("..") &&
+    /^[A-Za-z0-9._\/-]+$/.test(name)
+  );
+}

package/src/lib/security.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared request-origin guard for NeuralLoom.
+ *
+ * Contains NO Node-only imports so it can run in the Edge middleware runtime,
+ * in Node API routes, and in the raw `ws` gateway alike.
+ *
+ * Default posture is "localhost only": the dashboard, file/git/SQL APIs and the
+ * terminal gateway all expose powerful local capabilities (arbitrary shell,
+ * filesystem and DB access), so by default we only accept requests whose Host
+ * and Origin resolve to the loopback interface. This blocks LAN peers and
+ * defends against DNS-rebinding (where a malicious page carries the attacker's
+ * domain in Host/Origin while resolving to 127.0.0.1).
+ *
+ * Set NEURAL_LOOM_ALLOW_LAN=1 to expose the tool on the network. Even then we
+ * reject cross-site requests (Origin hostname must match the Host hostname) as a
+ * CSRF defense.
+ */
+
+const LOCAL_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+
+/** Extract the bare hostname from a Host header or Origin URL (no scheme/port). */
+export function hostnameOf(value: string | null | undefined): string | null {
+  if (!value) return null;
+  let v = value.trim();
+  if (!v) return null;
+  // Strip scheme (Origin headers look like "http://host:port")
+  v = v.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+  // Strip any path
+  v = v.split("/")[0];
+  // Bracketed IPv6, e.g. "[::1]:9601"
+  if (v.startsWith("[")) {
+    const end = v.indexOf("]");
+    return (end >= 0 ? v.slice(1, end) : v).toLowerCase();
+  }
+  // Strip ":port"
+  const colon = v.lastIndexOf(":");
+  if (colon >= 0) v = v.slice(0, colon);
+  return v.toLowerCase();
+}
+
+export function isLanAllowed(): boolean {
+  const v = (process.env.NEURAL_LOOM_ALLOW_LAN || "").toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+
+export function isLocalHostname(hostname: string | null): boolean {
+  return !!hostname && LOCAL_HOSTNAMES.has(hostname);
+}
+
+/** The interface the HTTP/WS servers should bind to given the current posture. */
+export function getBindHost(): string {
+  return process.env.NEURAL_LOOM_HOST || (isLanAllowed() ? "0.0.0.0" : "127.0.0.1");
+}
+
+/**
+ * Decide whether an HTTP/WS request is allowed based on its Host and Origin
+ * headers. See module docs for the policy.
+ */
+export function isRequestAllowed(
+  hostHeader: string | null,
+  originHeader: string | null
+): boolean {
+  const host = hostnameOf(hostHeader);
+  const origin = hostnameOf(originHeader);
+
+  if (!isLanAllowed()) {
+    if (!isLocalHostname(host)) return false;
+    // A present Origin must also be loopback (blocks rebinding/cross-site).
+    if (originHeader && !isLocalHostname(origin)) return false;
+    return true;
+  }
+
+  // LAN explicitly allowed: still block obvious cross-site requests.
+  if (originHeader && origin !== host) return false;
+  return true;
+}

package/src/lib/sql/McpServer.ts

@@ -1,6 +1,7 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import readline from "readline";
 import { ConnectionManager } from "./ConnectionManager";
+import { isReadOnlyViolation } from "./sqlGuard";
 
 export class McpServer {
   private workspaceRoot?: string;
@@ -232,17 +233,7 @@ export class McpServer {
             return;
           }
           
-          const clean = sql.trim().toLowerCase();
-          const isMutation = clean.startsWith("insert") ||
-                             clean.startsWith("update") ||
-                             clean.startsWith("delete") ||
-                             clean.startsWith("drop") ||
-                             clean.startsWith("alter") ||
-                             clean.startsWith("create") ||
-                             clean.startsWith("truncate") ||
-                             clean.startsWith("replace");
-
-          if (profile.readOnly && isMutation) {
+          if (profile.readOnly && isReadOnlyViolation(sql)) {
             this.sendToolResult(id, "Error: Access Denied. This database connection is configured as Read-Only.", true);
             return;
           }

package/src/lib/sql/adapters/MssqlAdapter.ts

@@ -41,8 +41,23 @@ export class MssqlAdapter extends DbAdapter {
     }
   }
 
+  // Validate the cached connection before use; transparently reconnect if the
+  // server dropped it (the pooled adapter instance is long-lived).
+  private async ensureLive(): Promise<void> {
+    if (!this.pool) {
+      await this.connect();
+      return;
+    }
+    try {
+      await this.pool.request().query("SELECT 1");
+    } catch {
+      try { await this.disconnect(); } catch { /* ignore */ }
+      await this.connect();
+    }
+  }
+
   async query(sql: string, params: any[] = []): Promise<QueryResult> {
-    await this.connect();
+    await this.ensureLive();
     try {
       const request = this.pool.request();
       

package/src/lib/sql/adapters/MysqlAdapter.ts

@@ -31,6 +31,13 @@ export class MysqlAdapter extends DbAdapter {
         password: this.config.password || "",
         ssl: this.config.ssl ? this.config.ssl : undefined
       });
+
+      // Enforce read-only at the session level. With autocommit each statement
+      // runs in its own read-only transaction, so writes are rejected by the
+      // server rather than relying solely on our SQL guard.
+      if (this.config.readOnly) {
+        await this.connection.query("SET SESSION TRANSACTION READ ONLY");
+      }
     } catch (err: any) {
       console.error("[MysqlAdapter] Connect failed:", err);
       this.connection = null;
@@ -38,8 +45,23 @@ export class MysqlAdapter extends DbAdapter {
     }
   }
 
+  // Validate the cached connection before use; transparently reconnect if the
+  // server dropped it (the pooled adapter instance is long-lived).
+  private async ensureLive(): Promise<void> {
+    if (!this.connection) {
+      await this.connect();
+      return;
+    }
+    try {
+      await this.connection.query("SELECT 1");
+    } catch {
+      try { await this.disconnect(); } catch { /* ignore */ }
+      await this.connect();
+    }
+  }
+
   async query(sql: string, params: any[] = []): Promise<QueryResult> {
-    await this.connect();
+    await this.ensureLive();
     try {
       const [rows, fields] = await this.connection.execute(sql, params);
       

package/src/lib/sql/adapters/PostgresAdapter.ts

@@ -34,6 +34,12 @@ export class PostgresAdapter extends DbAdapter {
       });
 
       await this.client.connect();
+
+      // Enforce read-only at the session level so every subsequent statement
+      // (including CTEs and stacked statements) is rejected by the server.
+      if (this.config.readOnly) {
+        await this.client.query("SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY");
+      }
     } catch (err: any) {
       console.error("[PostgresAdapter] Connect failed:", err);
       this.client = null;
@@ -41,8 +47,23 @@ export class PostgresAdapter extends DbAdapter {
     }
   }
 
+  // Validate the cached connection before use; transparently reconnect if the
+  // server dropped it (the pooled adapter instance is long-lived).
+  private async ensureLive(): Promise<void> {
+    if (!this.client) {
+      await this.connect();
+      return;
+    }
+    try {
+      await this.client.query("SELECT 1");
+    } catch {
+      try { await this.disconnect(); } catch { /* ignore */ }
+      await this.connect();
+    }
+  }
+
   async query(sql: string, params: any[] = []): Promise<QueryResult> {
-    await this.connect();
+    await this.ensureLive();
     try {
       const res = await this.client.query(sql, params);
       const rows = res.rows || [];

package/src/lib/sql/adapters/SqliteAdapter.ts

@@ -21,11 +21,13 @@ export class SqliteAdapter extends DbAdapter {
 
   async connect(): Promise<void> {
     if (this.db) return;
-    
-    // Ensure parent directory exists
-    const dir = path.dirname(this.resolvedPath);
-    if (!fs.existsSync(dir)) {
-      fs.mkdirSync(dir, { recursive: true });
+
+    // Ensure parent directory exists (only when we may create/write the file).
+    if (!this.config.readOnly) {
+      const dir = path.dirname(this.resolvedPath);
+      if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+      }
     }
 
     try {
@@ -39,17 +41,26 @@ export class SqliteAdapter extends DbAdapter {
         );
       }
 
-      this.db = new Database(this.resolvedPath);
+      // Read-only profiles open the database with the driver's readonly flag, so
+      // any write attempt fails at the engine level (not just our SQL guard).
+      this.db = new Database(this.resolvedPath, this.config.readOnly ? { readonly: true } : {});
     } catch (err: any) {
       console.error("[SqliteAdapter] Connect failed:", err);
       throw err;
     }
   }
 
-  async query(sql: string, params: any[] = []): Promise<QueryResult> {
+  // Reopen the database handle if it was closed (e.g. after a disconnect).
+  private async ensureLive(): Promise<void> {
+    if (this.db && this.db.open) return;
+    this.db = null;
     await this.connect();
+  }
+
+  async query(sql: string, params: any[] = []): Promise<QueryResult> {
+    await this.ensureLive();
     try {
-      const isSelect = sql.trim().toLowerCase().startsWith("select") || 
+      const isSelect = sql.trim().toLowerCase().startsWith("select") ||
                        sql.trim().toLowerCase().startsWith("pragma") ||
                        sql.trim().toLowerCase().startsWith("explain");
       
@@ -80,8 +91,8 @@ export class SqliteAdapter extends DbAdapter {
   }
 
   async describeTable(tableName: string): Promise<ColumnSchema[]> {
-    await this.connect();
-    
+    await this.ensureLive();
+
     // Get table columns
     const columnsInfo = this.db.prepare(`PRAGMA table_info(\`${tableName}\`)`).all();
     // Get foreign keys

package/src/lib/sql/sqlGuard.ts

@@ -0,0 +1,20 @@
+/**
+ * Backstop guard for read-only DB connections.
+ *
+ * Real enforcement happens at the driver/transaction level (SQLite opened
+ * read-only, Postgres/MySQL session set READ ONLY). This statement inspection is
+ * a defense-in-depth layer and the only available guard for drivers without a
+ * session read-only mode (e.g. MSSQL). It strips SQL comments first so a leading
+ * comment trick can't hide a mutation, and matches mutation keywords anywhere
+ * (covering CTEs such as `WITH x AS (...) DELETE ...` and stacked statements
+ * like `SELECT 1; DROP TABLE t`). It intentionally errs toward over-blocking.
+ */
+export function isReadOnlyViolation(sql: string): boolean {
+  if (!sql) return false;
+  const stripped = sql
+    .replace(/\/\*[\s\S]*?\*\//g, " ") // block comments
+    .replace(/--[^\n]*/g, " "); // line comments
+  return /\b(insert|update|delete|drop|alter|create|truncate|replace|grant|revoke|merge|exec|execute)\b/i.test(
+    stripped
+  );
+}

package/src/lib/workspaceParser.ts

@@ -1,29 +1,45 @@
 import fs from "fs";
 import path from "path";
 
+// Cache parsed folders per workspace root, keyed off the .code-workspace file's
+// mtime so repeated polling doesn't re-read and re-parse it every call.
+const folderCache = new Map<string, { mtimeMs: number; folders: string[] }>();
+
 export function getWorkspaceFileFolders(workspaceRoot: string): string[] {
   try {
     if (!workspaceRoot || !fs.existsSync(workspaceRoot)) return [];
-    
+
     // Normalize workspaceRoot path
     const normRoot = path.resolve(workspaceRoot).replace(/\\/g, "/");
-    
+
     const files = fs.readdirSync(normRoot);
     const workspaceFile = files.find(f => f.endsWith(".code-workspace"));
-    if (!workspaceFile) return [];
+    if (!workspaceFile) {
+      folderCache.delete(normRoot);
+      return [];
+    }
 
     const filePath = path.join(normRoot, workspaceFile);
+    const mtimeMs = fs.statSync(filePath).mtimeMs;
+    const cached = folderCache.get(normRoot);
+    if (cached && cached.mtimeMs === mtimeMs) {
+      return cached.folders;
+    }
+
     const content = fs.readFileSync(filePath, "utf8");
     const json = JSON.parse(content);
     
-    if (!json.folders || !Array.isArray(json.folders)) return [];
-    
+    if (!json.folders || !Array.isArray(json.folders)) {
+      folderCache.set(normRoot, { mtimeMs, folders: [] });
+      return [];
+    }
+
     const folders: string[] = [];
     for (const folder of json.folders) {
       if (folder.path) {
         // Resolve relative to workspace root (where the workspace file resides)
         const resolved = path.resolve(normRoot, folder.path).replace(/\\/g, "/");
-        
+
         // Exclude the workspace root folder itself
         if (resolved !== normRoot) {
           if (fs.existsSync(resolved)) {
@@ -32,6 +48,7 @@ export function getWorkspaceFileFolders(workspaceRoot: string): string[] {
         }
       }
     }
+    folderCache.set(normRoot, { mtimeMs, folders });
     return folders;
   } catch (err) {
     console.error("[WorkspaceParser] Failed to parse code-workspace file:", err);

package/src/middleware.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { isRequestAllowed } from "@/lib/security";
+
+// Gate every API route behind the localhost-origin guard. The dashboard's APIs
+// expose arbitrary shell, filesystem and database access, so cross-origin / LAN
+// callers are rejected unless NEURAL_LOOM_ALLOW_LAN is explicitly set.
+export function middleware(request: NextRequest) {
+  const host = request.headers.get("host");
+  const origin = request.headers.get("origin");
+
+  if (!isRequestAllowed(host, origin)) {
+    return NextResponse.json(
+      {
+        error:
+          "Forbidden: NeuralLoom only accepts requests from localhost. Set NEURAL_LOOM_ALLOW_LAN=1 to permit network access.",
+      },
+      { status: 403 }
+    );
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: "/api/:path*",
+};

package/.next/server/chunks/[externals]__048y_op._.js

@@ -1,3 +0,0 @@
-module.exports=[93695,(e,r,t)=>{r.exports=e.x("next/dist/shared/lib/no-fallback-error.external.js",()=>require("next/dist/shared/lib/no-fallback-error.external.js"))},18622,(e,r,t)=>{r.exports=e.x("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js",()=>require("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js"))},56704,(e,r,t)=>{r.exports=e.x("next/dist/server/app-render/work-async-storage.external.js",()=>require("next/dist/server/app-render/work-async-storage.external.js"))},32319,(e,r,t)=>{r.exports=e.x("next/dist/server/app-render/work-unit-async-storage.external.js",()=>require("next/dist/server/app-render/work-unit-async-storage.external.js"))},24725,(e,r,t)=>{r.exports=e.x("next/dist/server/app-render/after-task-async-storage.external.js",()=>require("next/dist/server/app-render/after-task-async-storage.external.js"))},70406,(e,r,t)=>{r.exports=e.x("next/dist/compiled/@opentelemetry/api",()=>require("next/dist/compiled/@opentelemetry/api"))},14747,(e,r,t)=>{r.exports=e.x("path",()=>require("path"))},46786,(e,r,t)=>{r.exports=e.x("os",()=>require("os"))}];
-
-//# sourceMappingURL=%5Bexternals%5D__048y_op._.js.map

package/.next/server/chunks/[externals]__048y_op._.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":""}