ompgui 0.4.0

package/bin/omp-web-security.test.mjs

@@ -0,0 +1,9 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+test("launcher refuses unauthenticated non-loopback binds", async () => {
+  const source = await readFile(new URL("./omp-web.js", import.meta.url), "utf8");
+  assert.match(source, /Refusing to listen on/);
+  assert.match(source, /!passwordEnabled/);
+});

package/bin/omp-web.js

@@ -0,0 +1,155 @@
+#!/usr/bin/env node
+"use strict";
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { getUnsupportedNodeVersionMessage, isNodeVersionSupported } = require("./node-version");
+
+if (!isNodeVersionSupported(process.versions.node)) {
+  console.error(getUnsupportedNodeVersionMessage(process.versions.node));
+  process.exit(1);
+}
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { spawn } = require("child_process");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const path = require("path");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const fs = require("fs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { parseLaunchOptions } = require("./omp-web-options");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { isPortAvailable } = require("./port-availability");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { wireChildProcessLifecycle } = require("./process-lifecycle");
+
+const pkgDir = path.join(__dirname, "..");
+const nextDir = path.join(pkgDir, ".next");
+
+// Resolve next's CLI entry directly to avoid relying on .bin symlinks (which
+// may not exist when installed via npx).
+let nextBin;
+try {
+  nextBin = require.resolve("next/dist/bin/next", { paths: [pkgDir] });
+} catch {
+  // Fallback: locate next package root and derive the bin path manually.
+  try {
+    const nextPkg = require.resolve("next/package.json", { paths: [pkgDir] });
+    nextBin = path.join(path.dirname(nextPkg), "dist", "bin", "next");
+  } catch {
+    nextBin = path.join(pkgDir, "node_modules", "next", "dist", "bin", "next");
+  }
+}
+
+const launchOptions = parseLaunchOptions();
+if (launchOptions.help || launchOptions.version) {
+  process.exit(0);
+}
+const port = launchOptions.port;
+const hostname = launchOptions.hostname;
+const password = launchOptions.password;
+const openBrowser = launchOptions.openBrowser;
+// Propagate --password into the env for proxy.ts / lib/web-auth.ts and the spawned Next process.
+if (password) process.env.OMP_WEB_PASSWORD = password;
+const loopbackHostnames = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+const passwordEnabled = typeof password === "string" && password.length > 0;
+
+if (!fs.existsSync(nextDir)) {
+  console.error("Build artifacts not found. Please report this issue.");
+  process.exit(1);
+}
+
+if (!loopbackHostnames.has(hostname)) {
+  if (!passwordEnabled) {
+    console.error(`Refusing to listen on ${hostname} without OMP_WEB_PASSWORD (or --password). Set a strong password or bind to 127.0.0.1.`);
+    process.exit(1);
+  }
+  console.warn(`Warning: ompweb is listening on ${hostname} over HTTP. Use HTTPS or a trusted VPN to protect the password and session cookie in transit.`);
+}
+
+const nextArgs = ["start", "-p", port];
+nextArgs.push("-H", hostname);
+
+// Always run next's JS entry with node directly — avoids .bin symlink issues
+// and path-with-spaces problems on Windows when shell: true is used.
+const url = `http://${hostname}:${port}`;
+
+function openBrowserWindow(targetUrl) {
+  const isWindows = process.platform === "win32";
+  const isMac = process.platform === "darwin";
+  const isWsl = process.platform === "linux" && Boolean(process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP);
+  const openCmd = isWindows ? "cmd.exe" : isMac ? "open" : isWsl ? "wslview" : "xdg-open";
+  const openArgs = isWindows ? ["/c", "start", "", targetUrl] : [targetUrl];
+
+  try {
+    const opener = spawn(openCmd, openArgs, {
+      stdio: "ignore",
+      detached: true,
+    });
+    opener.on("error", (error) => {
+      console.warn(`Could not open browser automatically: ${error.message}`);
+    });
+    opener.unref();
+  } catch (error) {
+    console.warn(`Could not open browser automatically: ${error.message}`);
+  }
+}
+
+async function main() {
+  if (!await isPortAvailable(port, hostname)) {
+    console.log(`ompweb is already running on ${hostname}:${port}.`);
+    if (openBrowser) {
+      console.log(`Opening ${url} in your browser...`);
+      openBrowserWindow(url);
+    }
+    return;
+  }
+
+  const child = spawn(process.execPath, [nextBin, ...nextArgs], {
+    cwd: pkgDir,
+    stdio: ["inherit", "pipe", "inherit"],
+    env: {
+      ...process.env,
+      OMP_WEB_PACKAGE_DIR: pkgDir,
+      OMP_WEB_LAUNCHER_PID: String(process.pid),
+      OMP_WEB_PORT: port,
+      OMP_WEB_HOSTNAME: hostname,
+    },
+  });
+  wireChildProcessLifecycle(child);
+
+  let browserOpened = false;
+  const tryOpenBrowser = () => {
+    if (!openBrowser || browserOpened) return;
+    browserOpened = true;
+    openBrowserWindow(url);
+  };
+
+  child.stdout.on("data", (chunk) => {
+    const text = chunk.toString();
+    process.stdout.write(text);
+    if (/ready|started|local:\s*http|listening/i.test(text)) {
+      tryOpenBrowser();
+    }
+  });
+
+  if (openBrowser) {
+    const checkInterval = setInterval(async () => {
+      if (browserOpened) {
+        clearInterval(checkInterval);
+        return;
+      }
+      const available = await isPortAvailable(port, hostname);
+      if (!available) {
+        clearInterval(checkInterval);
+        tryOpenBrowser();
+      }
+    }, 250);
+
+    setTimeout(() => clearInterval(checkInterval), 15000);
+  }
+}
+
+main().catch((error) => {
+  console.error(`Could not check whether ${url} is available: ${error.message}`);
+  process.exit(1);
+});

package/bin/port-availability.js

@@ -0,0 +1,27 @@
+"use strict";
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const net = require("net");
+
+function isPortAvailable(port, hostname) {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+
+    server.once("error", (error) => {
+      if (error.code === "EADDRINUSE") {
+        resolve(false);
+      } else {
+        reject(error);
+      }
+    });
+
+    server.listen({ port: Number(port), host: hostname }, () => {
+      server.close((error) => {
+        if (error) reject(error);
+        else resolve(true);
+      });
+    });
+  });
+}
+
+module.exports = { isPortAvailable };

package/bin/process-lifecycle.js

@@ -0,0 +1,71 @@
+"use strict";
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const os = require("node:os");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { spawn } = require("node:child_process");
+
+const forwardedSignals = ["SIGINT", "SIGTERM"];
+const shutdownTimeoutMs = 5_000;
+
+function getSignalExitCode(signal) {
+  const signalNumber = signal ? os.constants.signals[signal] : undefined;
+  return typeof signalNumber === "number" ? 128 + signalNumber : 1;
+}
+
+function killChildTree(child, force, platform = process.platform) {
+  if (platform === "win32" && child.pid) {
+    const reaper = spawn("taskkill", ["/pid", String(child.pid), "/t", ...(force ? ["/f"] : [])], {
+      windowsHide: true,
+      stdio: "ignore",
+    });
+    reaper.once("error", () => {
+      try { child.kill(force ? "SIGKILL" : "SIGTERM"); } catch {}
+    });
+    reaper.unref?.();
+    return;
+  }
+
+  try { child.kill(force ? "SIGKILL" : "SIGTERM"); } catch {}
+}
+
+function wireChildProcessLifecycle(child, parentProcess = process, timeoutMs = shutdownTimeoutMs) {
+  const signalHandlers = new Map();
+  let shutdownTimer;
+  const platform = parentProcess.platform ?? process.platform;
+
+  const forceKill = () => killChildTree(child, true, platform);
+
+  for (const signal of forwardedSignals) {
+    const handler = () => {
+      if (shutdownTimer) {
+        forceKill();
+        return;
+      }
+
+      shutdownTimer = setTimeout(forceKill, timeoutMs);
+      shutdownTimer.unref?.();
+      try {
+        child.kill(signal);
+      } catch {
+        // Windows has limited signal support. Ask taskkill to terminate the
+        // child tree if the native signal could not be delivered.
+        if (platform === "win32") killChildTree(child, false, platform);
+      }
+    };
+    signalHandlers.set(signal, handler);
+    parentProcess.on(signal, handler);
+  }
+
+  child.once("exit", (code, signal) => {
+    if (shutdownTimer) clearTimeout(shutdownTimer);
+
+    for (const [forwardedSignal, handler] of signalHandlers) {
+      parentProcess.removeListener(forwardedSignal, handler);
+    }
+
+    parentProcess.exit(code ?? getSignalExitCode(signal));
+  });
+}
+
+module.exports = { wireChildProcessLifecycle };

package/bin/process-lifecycle.test.mjs

@@ -0,0 +1,83 @@
+import assert from "node:assert/strict";
+import { EventEmitter } from "node:events";
+import test from "node:test";
+import { setTimeout as delay } from "node:timers/promises";
+
+import { wireChildProcessLifecycle } from "./process-lifecycle.js";
+
+function createProcesses() {
+  const parent = new EventEmitter();
+  const child = new EventEmitter();
+  const forwardedSignals = [];
+  const exitCodes = [];
+
+  child.kill = (signal) => {
+    forwardedSignals.push(signal);
+    return true;
+  };
+  parent.exit = (code) => {
+    exitCodes.push(code);
+  };
+
+  return { parent, child, forwardedSignals, exitCodes };
+}
+
+test("forwards the first shutdown signal and force-kills on repeated signals", () => {
+  const { parent, child, forwardedSignals } = createProcesses();
+
+  wireChildProcessLifecycle(child, parent);
+  parent.emit("SIGTERM");
+  parent.emit("SIGTERM");
+  parent.emit("SIGINT");
+
+  assert.deepEqual(forwardedSignals, ["SIGTERM", "SIGKILL", "SIGKILL"]);
+  child.emit("exit", null, "SIGKILL");
+});
+
+test("propagates a child exit code and clears its shutdown wiring", async () => {
+  const { parent, child, forwardedSignals, exitCodes } = createProcesses();
+  const existingSigtermListener = () => {};
+  parent.on("SIGTERM", existingSigtermListener);
+
+  wireChildProcessLifecycle(child, parent, 10);
+  assert.equal(parent.listenerCount("SIGINT"), 1);
+  assert.equal(parent.listenerCount("SIGTERM"), 2);
+
+  parent.emit("SIGTERM");
+  child.emit("exit", 23, null);
+  await delay(20);
+
+  assert.deepEqual(exitCodes, [23]);
+  assert.equal(parent.listenerCount("SIGINT"), 0);
+  assert.deepEqual(parent.listeners("SIGTERM"), [existingSigtermListener]);
+
+  parent.emit("SIGTERM");
+  assert.deepEqual(forwardedSignals, ["SIGTERM"]);
+});
+
+test("force-kills the child when graceful shutdown times out", async () => {
+  const { parent, child, forwardedSignals } = createProcesses();
+
+  wireChildProcessLifecycle(child, parent, 10);
+  parent.emit("SIGINT");
+  assert.deepEqual(forwardedSignals, ["SIGINT"]);
+
+  await delay(20);
+
+  assert.deepEqual(forwardedSignals, ["SIGINT", "SIGKILL"]);
+  child.emit("exit", null, "SIGKILL");
+});
+
+test("uses conventional exit statuses for known child signals", () => {
+  for (const [signal, expectedExitCode] of [
+    ["SIGTERM", 143],
+    ["SIGKILL", 137],
+  ]) {
+    const { parent, child, exitCodes } = createProcesses();
+
+    wireChildProcessLifecycle(child, parent);
+    child.emit("exit", null, signal);
+
+    assert.deepEqual(exitCodes, [expectedExitCode]);
+  }
+});

package/next.config.ts

@@ -0,0 +1,91 @@
+import type { NextConfig } from "next";
+import { readFileSync } from "fs";
+import { join } from "path";
+import { PHASE_DEVELOPMENT_SERVER } from "next/constants";
+
+const { version } = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8")) as { version: string };
+
+// Function form: `phase` is authoritative even when the host environment
+// carries a stray NODE_ENV (e.g. NODE_ENV=production inherited by `next dev`
+// processes). Relying on process.env.NODE_ENV here would apply the immutable
+// chunk rule in development, make the browser cache dev chunks forever, and
+// produce stale "module factory is not available" / hydration errors after
+// every restart.
+const nextConfig = (phase: string): NextConfig => {
+  const isDev = phase === PHASE_DEVELOPMENT_SERVER;
+  return {
+    // Keep standalone/server tracing inside this package. Without this explicit
+    // root, Next can choose a parent lockfile on Windows and traverse protected
+    // user-profile junctions while compiling.
+    outputFileTracingRoot: process.cwd(),
+    serverExternalPackages: ["undici"],
+    webpack(config: Parameters<NonNullable<NextConfig["webpack"]>>[0]) {
+      // Next's entrypoint tracer does not automatically reject dynamic paths
+      // outside the project root. Add parent/profile patterns to its ignore list
+      // so user filesystem discovery remains request-time only during builds.
+      for (const plugin of config.plugins ?? []) {
+        const candidate = plugin as unknown as {
+          constructor?: { name?: string };
+          traceIgnores?: string[];
+        };
+        if (candidate.constructor?.name === "TraceEntryPointsPlugin") {
+          candidate.traceIgnores ??= [];
+          candidate.traceIgnores.push("**/../**", "**/Users/**", "**/Application Data/**");
+        }
+      }
+      return config;
+    },
+    allowedDevOrigins: ["127.0.0.1", "192.168.*.*"],
+    // Security: stop advertising the runtime, and surface dev-mode problems
+    // earlier. Source maps in the browser bundle leak server path layout and
+    // bloat downloads without helping end users of a published app.
+    poweredByHeader: false,
+    reactStrictMode: true,
+    productionBrowserSourceMaps: false,
+    // Next.js enables gzip/brotli compression for `next start` by default; no
+    // custom compression middleware is needed (and would require a custom server).
+    async headers() {
+      const securityHeaders = [
+        { key: "X-Content-Type-Options", value: "nosniff" },
+        { key: "X-Frame-Options", value: "DENY" },
+        { key: "Referrer-Policy", value: "no-referrer" },
+        { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
+        { key: "Content-Security-Policy", value: "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; img-src 'self' data: blob: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' ws: wss:; font-src 'self' data:" },
+      ];
+      const headers = [
+        {
+          source: "/:path*",
+          headers: securityHeaders,
+        },
+        {
+          // Hashed build output never changes, so browsers/proxies may cache it
+          // immutably for a year and skip revalidation entirely.
+          // NOTE: scoped to /_next/static/ only — broader /_next/ patterns would
+          // shadow the HMR WebSocket in development.
+          source: "/_next/static/:path*",
+          headers: [
+            { key: "Cache-Control", value: "public, max-age=31536000, immutable" },
+          ],
+        },
+        {
+          source: "/",
+          headers: [
+            { key: "Cache-Control", value: "private, no-cache, max-age=0, must-revalidate" },
+          ],
+        },
+      ];
+
+      // Dev chunks have stable URLs whose content changes in place; caching
+      // them immutably would serve stale module factories after a restart.
+      if (isDev) return [headers[0], headers[2]];
+
+      return headers;
+    },
+    env: {
+      NEXT_PUBLIC_APP_VERSION: version,
+      NEXT_PUBLIC_OMP_WEB_VERSION: version,
+    },
+  };
+};
+
+export default nextConfig;

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "ompgui",
+  "version": "0.4.0",
+  "description": "Web UI for the oh-my-pi (omp) coding agent",
+  "homepage": "https://github.com/dbc-hbin/ompweb#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dbc-hbin/ompweb.git"
+  },
+  "bugs": {
+    "url": "https://github.com/dbc-hbin/ompweb/issues"
+  },
+  "author": "dbc-hbin",
+  "license": "MIT",
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "bin": {
+    "ompgui": "bin/omp-web.js",
+    "ompweb": "bin/omp-web.js"
+  },
+  "files": [
+    "bin",
+    ".next",
+    "!.next/cache",
+    "!.next/dev",
+    "!.next/diagnostics",
+    "!.next/types",
+    "!.next/trace",
+    "!.next/trace-build",
+    "!.next/**/*.map",
+    "public",
+    "next.config.ts",
+    "package.json"
+  ],
+  "scripts": {
+    "dev": "next dev -H 127.0.0.1 -p 30178",
+    "dev:lan": "next dev -H 0.0.0.0 -p 30178",
+    "build": "next build --webpack",
+    "start": "next start -H 127.0.0.1 -p 30177",
+    "start:lan": "next start -H 0.0.0.0 -p 30177",
+    "test": "node --experimental-strip-types --test lib/*.test.mjs lib/omp/*.test.mjs components/*.test.mjs components/ui/*.test.mjs hooks/*.test.mjs bin/*.test.mjs",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "prepack": "npm run build",
+    "release:check": "npm test && npm run build"
+  },
+  "dependencies": {
+    "@base-ui/react": "^1.6.0",
+    "cmdk": "^1.1.1",
+    "lucide-react": "^1.27.0",
+    "next": "16.3.0",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4",
+    "react-syntax-highlighter": "^16.1.1",
+    "undici": "8.10.0",
+    "yaml": "^2"
+  },
+  "devDependencies": {
+    "@lobehub/icons": "^5.6.0",
+    "@tailwindcss/postcss": "^4.2.2",
+    "@types/node": "^25",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@types/react-syntax-highlighter": "^15.5.13",
+    "eslint": "^9",
+    "eslint-config-next": "16.2.9",
+    "jiti": "^2.7.0",
+    "katex": "^0.16.47",
+    "mammoth": "^1.12.0",
+    "mermaid": "^11.14.0",
+    "postcss": "^8",
+    "react-markdown": "^10.1.0",
+    "rehype-katex": "^7.0.1",
+    "rehype-raw": "^7.0.0",
+    "rehype-sanitize": "^6.0.0",
+    "remark-gfm": "^4.0.1",
+    "remark-math": "^6.0.0",
+    "tailwindcss": "^4.2.2",
+    "typescript": "^5"
+  }
+}