neural-loom 0.2.70 → 0.3.0

package/src/lib/sql/sqlGuard.ts

@@ -0,0 +1,20 @@
+/**
+ * Backstop guard for read-only DB connections.
+ *
+ * Real enforcement happens at the driver/transaction level (SQLite opened
+ * read-only, Postgres/MySQL session set READ ONLY). This statement inspection is
+ * a defense-in-depth layer and the only available guard for drivers without a
+ * session read-only mode (e.g. MSSQL). It strips SQL comments first so a leading
+ * comment trick can't hide a mutation, and matches mutation keywords anywhere
+ * (covering CTEs such as `WITH x AS (...) DELETE ...` and stacked statements
+ * like `SELECT 1; DROP TABLE t`). It intentionally errs toward over-blocking.
+ */
+export function isReadOnlyViolation(sql: string): boolean {
+  if (!sql) return false;
+  const stripped = sql
+    .replace(/\/\*[\s\S]*?\*\//g, " ") // block comments
+    .replace(/--[^\n]*/g, " "); // line comments
+  return /\b(insert|update|delete|drop|alter|create|truncate|replace|grant|revoke|merge|exec|execute)\b/i.test(
+    stripped
+  );
+}

package/src/lib/workspaceParser.ts

@@ -1,29 +1,45 @@
 import fs from "fs";
 import path from "path";
 
+// Cache parsed folders per workspace root, keyed off the .code-workspace file's
+// mtime so repeated polling doesn't re-read and re-parse it every call.
+const folderCache = new Map<string, { mtimeMs: number; folders: string[] }>();
+
 export function getWorkspaceFileFolders(workspaceRoot: string): string[] {
   try {
     if (!workspaceRoot || !fs.existsSync(workspaceRoot)) return [];
-    
+
     // Normalize workspaceRoot path
     const normRoot = path.resolve(workspaceRoot).replace(/\\/g, "/");
-    
+
     const files = fs.readdirSync(normRoot);
     const workspaceFile = files.find(f => f.endsWith(".code-workspace"));
-    if (!workspaceFile) return [];
+    if (!workspaceFile) {
+      folderCache.delete(normRoot);
+      return [];
+    }
 
     const filePath = path.join(normRoot, workspaceFile);
+    const mtimeMs = fs.statSync(filePath).mtimeMs;
+    const cached = folderCache.get(normRoot);
+    if (cached && cached.mtimeMs === mtimeMs) {
+      return cached.folders;
+    }
+
     const content = fs.readFileSync(filePath, "utf8");
     const json = JSON.parse(content);
     
-    if (!json.folders || !Array.isArray(json.folders)) return [];
-    
+    if (!json.folders || !Array.isArray(json.folders)) {
+      folderCache.set(normRoot, { mtimeMs, folders: [] });
+      return [];
+    }
+
     const folders: string[] = [];
     for (const folder of json.folders) {
       if (folder.path) {
         // Resolve relative to workspace root (where the workspace file resides)
         const resolved = path.resolve(normRoot, folder.path).replace(/\\/g, "/");
-        
+
         // Exclude the workspace root folder itself
         if (resolved !== normRoot) {
           if (fs.existsSync(resolved)) {
@@ -32,6 +48,7 @@ export function getWorkspaceFileFolders(workspaceRoot: string): string[] {
         }
       }
     }
+    folderCache.set(normRoot, { mtimeMs, folders });
     return folders;
   } catch (err) {
     console.error("[WorkspaceParser] Failed to parse code-workspace file:", err);

package/src/middleware.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { isRequestAllowed } from "@/lib/security";
+
+// Gate every API route behind the localhost-origin guard. The dashboard's APIs
+// expose arbitrary shell, filesystem and database access, so cross-origin / LAN
+// callers are rejected unless NEURAL_LOOM_ALLOW_LAN is explicitly set.
+export function middleware(request: NextRequest) {
+  const host = request.headers.get("host");
+  const origin = request.headers.get("origin");
+
+  if (!isRequestAllowed(host, origin)) {
+    return NextResponse.json(
+      {
+        error:
+          "Forbidden: NeuralLoom only accepts requests from localhost. Set NEURAL_LOOM_ALLOW_LAN=1 to permit network access.",
+      },
+      { status: 403 }
+    );
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: "/api/:path*",
+};

package/.next/dev/build-manifest.json

@@ -1,50 +0,0 @@
-{
-  "pages": {
-    "/_app": [
-      "static/chunks/node_modules_next_dist_compiled_0o6l_m6._.js",
-      "static/chunks/node_modules_next_dist_shared_lib_0n1wg2c._.js",
-      "static/chunks/node_modules_next_dist_client_0pe1dg-._.js",
-      "static/chunks/node_modules_next_dist_0u_w_5s._.js",
-      "static/chunks/node_modules_next_app_0jt-zj..js",
-      "static/chunks/[next]_entry_page-loader_ts_0j~flwh._.js",
-      "static/chunks/node_modules_react-dom_0bruynb._.js",
-      "static/chunks/node_modules_0lx093h._.js",
-      "static/chunks/[root-of-the-server]__0c0okpg._.js",
-      "static/chunks/pages__app_07xvfw~._.js",
-      "static/chunks/turbopack-pages__app_0-bg2z-._.js"
-    ],
-    "/_error": [
-      "static/chunks/node_modules_next_dist_compiled_0o6l_m6._.js",
-      "static/chunks/node_modules_next_dist_shared_lib_0ek5eq7._.js",
-      "static/chunks/node_modules_next_dist_client_0pe1dg-._.js",
-      "static/chunks/node_modules_next_dist_0rt-2cr._.js",
-      "static/chunks/[next]_entry_page-loader_ts_0rqw6yo._.js",
-      "static/chunks/node_modules_react-dom_0bruynb._.js",
-      "static/chunks/node_modules_0lx093h._.js",
-      "static/chunks/[root-of-the-server]__01mw43t._.js",
-      "static/chunks/pages__error_07xvfw~._.js",
-      "static/chunks/turbopack-pages__error_0.i_zsq._.js"
-    ]
-  },
-  "devFiles": [],
-  "polyfillFiles": [
-    "static/chunks/node_modules_next_dist_build_polyfills_polyfill-nomodule.js"
-  ],
-  "lowPriorityFiles": [
-    "static/development/_buildManifest.js",
-    "static/development/_ssgManifest.js",
-    "static/development/_clientMiddlewareManifest.js"
-  ],
-  "rootMainFiles": [
-    "static/chunks/[turbopack]_browser_dev_hmr-client_hmr-client_ts_10z625~._.js",
-    "static/chunks/node_modules_next_dist_compiled_next-devtools_index_0553esy.js",
-    "static/chunks/node_modules_next_dist_compiled_react-dom_058-ah~._.js",
-    "static/chunks/node_modules_next_dist_compiled_react-server-dom-turbopack_0p3wegg._.js",
-    "static/chunks/node_modules_next_dist_compiled_0rpq4pf._.js",
-    "static/chunks/node_modules_next_dist_client_0fhqo1d._.js",
-    "static/chunks/node_modules_next_dist_115brz8._.js",
-    "static/chunks/node_modules_@swc_helpers_cjs_0-4ujiy._.js",
-    "static/chunks/_0rqeker._.js",
-    "static/chunks/turbopack-_0p44nws._.js"
-  ]
-}

package/.next/dev/fallback-build-manifest.json

@@ -1,37 +0,0 @@
-{
-  "pages": {
-    "/_app": [
-      "static/chunks/node_modules_next_dist_compiled_0o6l_m6._.js",
-      "static/chunks/node_modules_next_dist_shared_lib_0n1wg2c._.js",
-      "static/chunks/node_modules_next_dist_client_0pe1dg-._.js",
-      "static/chunks/node_modules_next_dist_0u_w_5s._.js",
-      "static/chunks/node_modules_next_app_0jt-zj..js",
-      "static/chunks/[next]_entry_page-loader_ts_0j~flwh._.js",
-      "static/chunks/node_modules_react-dom_0bruynb._.js",
-      "static/chunks/node_modules_0lx093h._.js",
-      "static/chunks/[root-of-the-server]__0c0okpg._.js",
-      "static/chunks/pages__app_07xvfw~._.js",
-      "static/chunks/turbopack-pages__app_0-bg2z-._.js"
-    ],
-    "/_error": [
-      "static/chunks/node_modules_next_dist_compiled_0o6l_m6._.js",
-      "static/chunks/node_modules_next_dist_shared_lib_0ek5eq7._.js",
-      "static/chunks/node_modules_next_dist_client_0pe1dg-._.js",
-      "static/chunks/node_modules_next_dist_0rt-2cr._.js",
-      "static/chunks/[next]_entry_page-loader_ts_0rqw6yo._.js",
-      "static/chunks/node_modules_react-dom_0bruynb._.js",
-      "static/chunks/node_modules_0lx093h._.js",
-      "static/chunks/[root-of-the-server]__01mw43t._.js",
-      "static/chunks/pages__error_07xvfw~._.js",
-      "static/chunks/turbopack-pages__error_0.i_zsq._.js"
-    ]
-  },
-  "devFiles": [],
-  "polyfillFiles": [],
-  "lowPriorityFiles": [
-    "static/development/_buildManifest.js",
-    "static/development/_ssgManifest.js",
-    "static/development/_clientMiddlewareManifest.js"
-  ],
-  "rootMainFiles": []
-}