ruflo 3.7.0-alpha.11 → 3.7.0-alpha.13

package/src/ruvocal/src/lib/server/urlSafety.ts

@@ -1,77 +1,77 @@
-import { Address4, Address6 } from "ip-address";
-import { isIP } from "node:net";
-
-const UNSAFE_IPV4_SUBNETS = [
-	"0.0.0.0/8",
-	"100.64.0.0/10",
-	"127.0.0.0/8",
-	"169.254.0.0/16",
-	"172.16.0.0/12",
-	"192.168.0.0/16",
-].map((s) => new Address4(s));
-
-function isUnsafeIp(address: string): boolean {
-	const family = isIP(address);
-
-	if (family === 4) {
-		const addr = new Address4(address);
-		return UNSAFE_IPV4_SUBNETS.some((subnet) => addr.isInSubnet(subnet));
-	}
-
-	if (family === 6) {
-		const addr = new Address6(address);
-		// Check IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1)
-		if (addr.is4()) {
-			const v4 = addr.to4();
-			return UNSAFE_IPV4_SUBNETS.some((subnet) => v4.isInSubnet(subnet));
-		}
-		return addr.isLoopback() || addr.isLinkLocal();
-	}
-
-	return true; // Unknown format → block
-}
-
-/**
- * Synchronous URL validation: checks protocol and hostname string.
- */
-export function isValidUrl(urlString: string): boolean {
-	try {
-		const url = new URL(urlString.trim());
-		const hostname = url.hostname.toLowerCase();
-		// Allow HTTP for localhost/loopback/Docker-internal (dev & local MCP bridge)
-		if (
-			hostname === "localhost" ||
-			hostname === "127.0.0.1" ||
-			hostname === "::1" ||
-			hostname === "host.docker.internal"
-		) {
-			return url.protocol === "http:" || url.protocol === "https:";
-		}
-		// Allow HTTP for Docker-internal service names (no dots = private network)
-		if (!hostname.includes(".") && url.protocol === "http:") {
-			return true;
-		}
-		if (url.protocol !== "https:") {
-			return false;
-		}
-		// If the hostname is a raw IP literal, validate it
-		const cleanHostname = hostname.replace(/^\[|]$/g, "");
-		if (isIP(cleanHostname)) {
-			return !isUnsafeIp(cleanHostname);
-		}
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-/**
- * Assert that a resolved IP address is safe (not internal/private).
- * Throws if the IP is internal. Used in undici's custom DNS lookup
- * to validate IPs at connection time (prevents TOCTOU DNS rebinding).
- */
-export function assertSafeIp(address: string, hostname: string): void {
-	if (isUnsafeIp(address)) {
-		throw new Error(`Resolved IP for ${hostname} is internal (${address})`);
-	}
-}
+import { Address4, Address6 } from "ip-address";
+import { isIP } from "node:net";
+
+const UNSAFE_IPV4_SUBNETS = [
+	"0.0.0.0/8",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"169.254.0.0/16",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+].map((s) => new Address4(s));
+
+function isUnsafeIp(address: string): boolean {
+	const family = isIP(address);
+
+	if (family === 4) {
+		const addr = new Address4(address);
+		return UNSAFE_IPV4_SUBNETS.some((subnet) => addr.isInSubnet(subnet));
+	}
+
+	if (family === 6) {
+		const addr = new Address6(address);
+		// Check IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1)
+		if (addr.is4()) {
+			const v4 = addr.to4();
+			return UNSAFE_IPV4_SUBNETS.some((subnet) => v4.isInSubnet(subnet));
+		}
+		return addr.isLoopback() || addr.isLinkLocal();
+	}
+
+	return true; // Unknown format → block
+}
+
+/**
+ * Synchronous URL validation: checks protocol and hostname string.
+ */
+export function isValidUrl(urlString: string): boolean {
+	try {
+		const url = new URL(urlString.trim());
+		const hostname = url.hostname.toLowerCase();
+		// Allow HTTP for localhost/loopback/Docker-internal (dev & local MCP bridge)
+		if (
+			hostname === "localhost" ||
+			hostname === "127.0.0.1" ||
+			hostname === "::1" ||
+			hostname === "host.docker.internal"
+		) {
+			return url.protocol === "http:" || url.protocol === "https:";
+		}
+		// Allow HTTP for Docker-internal service names (no dots = private network)
+		if (!hostname.includes(".") && url.protocol === "http:") {
+			return true;
+		}
+		if (url.protocol !== "https:") {
+			return false;
+		}
+		// If the hostname is a raw IP literal, validate it
+		const cleanHostname = hostname.replace(/^\[|]$/g, "");
+		if (isIP(cleanHostname)) {
+			return !isUnsafeIp(cleanHostname);
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Assert that a resolved IP address is safe (not internal/private).
+ * Throws if the IP is internal. Used in undici's custom DNS lookup
+ * to validate IPs at connection time (prevents TOCTOU DNS rebinding).
+ */
+export function assertSafeIp(address: string, hostname: string): void {
+	if (isUnsafeIp(address)) {
+		throw new Error(`Resolved IP for ${hostname} is internal (${address})`);
+	}
+}

package/src/ruvocal/src/lib/server/usageLimits.ts

@@ -1,30 +1,30 @@
-import { z } from "zod";
-import { config } from "$lib/server/config";
-import JSON5 from "json5";
-
-const sanitizeJSONEnv = (val: string, fallback: string) => {
-	const raw = (val ?? "").trim();
-	const unquoted = raw.startsWith("`") && raw.endsWith("`") ? raw.slice(1, -1) : raw;
-	return unquoted || fallback;
-};
-
-// RATE_LIMIT is the legacy way to define messages per minute limit
-export const usageLimitsSchema = z
-	.object({
-		conversations: z.coerce.number().optional(), // how many conversations
-		messages: z.coerce.number().optional(), // how many messages in a conversation
-		messageLength: z.coerce.number().optional(), // how long can a message be before we cut it off
-		messagesPerMinute: z
-			.preprocess((val) => {
-				if (val === undefined) {
-					return config.RATE_LIMIT;
-				}
-				return val;
-			}, z.coerce.number().optional())
-			.optional(), // how many messages per minute
-	})
-	.optional();
-
-export const usageLimits = usageLimitsSchema.parse(
-	JSON5.parse(sanitizeJSONEnv(config.USAGE_LIMITS, "{}"))
-);
+import { z } from "zod";
+import { config } from "$lib/server/config";
+import JSON5 from "json5";
+
+const sanitizeJSONEnv = (val: string, fallback: string) => {
+	const raw = (val ?? "").trim();
+	const unquoted = raw.startsWith("`") && raw.endsWith("`") ? raw.slice(1, -1) : raw;
+	return unquoted || fallback;
+};
+
+// RATE_LIMIT is the legacy way to define messages per minute limit
+export const usageLimitsSchema = z
+	.object({
+		conversations: z.coerce.number().optional(), // how many conversations
+		messages: z.coerce.number().optional(), // how many messages in a conversation
+		messageLength: z.coerce.number().optional(), // how long can a message be before we cut it off
+		messagesPerMinute: z
+			.preprocess((val) => {
+				if (val === undefined) {
+					return config.RATE_LIMIT;
+				}
+				return val;
+			}, z.coerce.number().optional())
+			.optional(), // how many messages per minute
+	})
+	.optional();
+
+export const usageLimits = usageLimitsSchema.parse(
+	JSON5.parse(sanitizeJSONEnv(config.USAGE_LIMITS, "{}"))
+);

package/src/ruvocal/src/lib/stores/autopilotStore.svelte.ts

@@ -1,175 +1,175 @@
-/**
- * Autopilot Store — Svelte 5 runes-based store for managing autopilot Web Worker state.
- *
- * Provides reactive state for autopilot groups, tasks, and text content.
- * Communicates with AutopilotWorker and DetailFetchWorker via postMessage.
- *
- * ADR-037 Part 2+3: Parallel Task UI + Web Workers
- */
-
-import type { GroupState, AutopilotUIUpdate } from "$lib/workers/autopilotWorker";
-import type { DetailWorkerOutgoing } from "$lib/workers/detailFetchWorker";
-
-export interface AutopilotState {
-	active: boolean;
-	maxSteps: number;
-	groups: GroupState[];
-	textContent: string;
-	error: string | null;
-	totalSteps: number;
-	totalTasks: number;
-	duration: number;
-	paused: boolean;
-	pauseReason: string | null;
-}
-
-const defaultState: AutopilotState = {
-	active: false,
-	maxSteps: 20,
-	groups: [],
-	textContent: "",
-	error: null,
-	totalSteps: 0,
-	totalTasks: 0,
-	duration: 0,
-	paused: false,
-	pauseReason: null,
-};
-
-let state = $state<AutopilotState>({ ...defaultState });
-
-let autopilotWorker: Worker | null = null;
-let detailWorker: Worker | null = null;
-const detailCallbacks = new Map<string, (content: string | null, error?: string) => void>();
-
-async function ensureWorkers() {
-	if (typeof window === "undefined") return;
-
-	if (!autopilotWorker) {
-		const mod = await import("$lib/workers/autopilotWorker?worker");
-		autopilotWorker = new mod.default();
-		autopilotWorker.onmessage = handleWorkerMessage;
-	}
-
-	if (!detailWorker) {
-		const mod = await import("$lib/workers/detailFetchWorker?worker");
-		detailWorker = new mod.default();
-		detailWorker.onmessage = handleDetailMessage;
-	}
-}
-
-function handleWorkerMessage(e: MessageEvent) {
-	const msg = e.data;
-
-	switch (msg.type) {
-		case "batch_update":
-			state.groups = msg.groups;
-			for (const update of msg.updates as AutopilotUIUpdate[]) {
-				applyUpdate(update);
-			}
-			break;
-
-		case "text":
-			state.textContent += msg.content;
-			break;
-
-		case "done":
-			state.active = false;
-			state.groups = msg.groups;
-			break;
-
-		case "error":
-			state.active = false;
-			state.error = msg.error;
-			break;
-
-		case "stopped":
-			state.active = false;
-			state.groups = msg.groups;
-			break;
-	}
-}
-
-function applyUpdate(update: AutopilotUIUpdate) {
-	switch (update.type) {
-		case "start":
-			state.maxSteps = update.maxSteps;
-			break;
-		case "end":
-			state.totalSteps = update.totalSteps;
-			state.totalTasks = update.totalTasks;
-			state.duration = update.duration;
-			break;
-		case "text":
-			state.textContent += update.content;
-			break;
-		case "paused":
-			state.paused = true;
-			state.pauseReason = update.reason;
-			break;
-		case "error_event":
-			state.error = update.error;
-			break;
-	}
-}
-
-function handleDetailMessage(e: MessageEvent<DetailWorkerOutgoing>) {
-	const msg = e.data;
-	if (msg.type === "detail") {
-		const cb = detailCallbacks.get(msg.detailToken);
-		if (cb) {
-			cb(msg.content);
-			detailCallbacks.delete(msg.detailToken);
-		}
-	} else if (msg.type === "detail_error") {
-		const cb = detailCallbacks.get(msg.detailToken);
-		if (cb) {
-			cb(null, msg.error);
-			detailCallbacks.delete(msg.detailToken);
-		}
-	}
-}
-
-export function useAutopilot() {
-	return {
-		get state() {
-			return state;
-		},
-
-		async start(url: string, headers: Record<string, string>, body: unknown) {
-			await ensureWorkers();
-			Object.assign(state, { ...defaultState, active: true });
-			autopilotWorker?.postMessage({ type: "start", url, headers, body });
-		},
-
-		stop() {
-			autopilotWorker?.postMessage({ type: "stop" });
-		},
-
-		async fetchDetail(detailToken: string, bridgeUrl: string): Promise<string> {
-			await ensureWorkers();
-			return new Promise((resolve, reject) => {
-				detailCallbacks.set(detailToken, (content, error) => {
-					if (error) reject(new Error(error));
-					else resolve(content!);
-				});
-				detailWorker?.postMessage({ type: "fetch", detailToken, bridgeUrl });
-			});
-		},
-
-		prefetchDetail(detailToken: string, bridgeUrl: string) {
-			detailWorker?.postMessage({ type: "prefetch", detailToken, bridgeUrl });
-		},
-
-		evictDetail(detailToken: string) {
-			detailWorker?.postMessage({ type: "evict", detailToken });
-		},
-
-		destroy() {
-			autopilotWorker?.terminate();
-			detailWorker?.terminate();
-			autopilotWorker = null;
-			detailWorker = null;
-		},
-	};
-}
+/**
+ * Autopilot Store — Svelte 5 runes-based store for managing autopilot Web Worker state.
+ *
+ * Provides reactive state for autopilot groups, tasks, and text content.
+ * Communicates with AutopilotWorker and DetailFetchWorker via postMessage.
+ *
+ * ADR-037 Part 2+3: Parallel Task UI + Web Workers
+ */
+
+import type { GroupState, AutopilotUIUpdate } from "$lib/workers/autopilotWorker";
+import type { DetailWorkerOutgoing } from "$lib/workers/detailFetchWorker";
+
+export interface AutopilotState {
+	active: boolean;
+	maxSteps: number;
+	groups: GroupState[];
+	textContent: string;
+	error: string | null;
+	totalSteps: number;
+	totalTasks: number;
+	duration: number;
+	paused: boolean;
+	pauseReason: string | null;
+}
+
+const defaultState: AutopilotState = {
+	active: false,
+	maxSteps: 20,
+	groups: [],
+	textContent: "",
+	error: null,
+	totalSteps: 0,
+	totalTasks: 0,
+	duration: 0,
+	paused: false,
+	pauseReason: null,
+};
+
+let state = $state<AutopilotState>({ ...defaultState });
+
+let autopilotWorker: Worker | null = null;
+let detailWorker: Worker | null = null;
+const detailCallbacks = new Map<string, (content: string | null, error?: string) => void>();
+
+async function ensureWorkers() {
+	if (typeof window === "undefined") return;
+
+	if (!autopilotWorker) {
+		const mod = await import("$lib/workers/autopilotWorker?worker");
+		autopilotWorker = new mod.default();
+		autopilotWorker.onmessage = handleWorkerMessage;
+	}
+
+	if (!detailWorker) {
+		const mod = await import("$lib/workers/detailFetchWorker?worker");
+		detailWorker = new mod.default();
+		detailWorker.onmessage = handleDetailMessage;
+	}
+}
+
+function handleWorkerMessage(e: MessageEvent) {
+	const msg = e.data;
+
+	switch (msg.type) {
+		case "batch_update":
+			state.groups = msg.groups;
+			for (const update of msg.updates as AutopilotUIUpdate[]) {
+				applyUpdate(update);
+			}
+			break;
+
+		case "text":
+			state.textContent += msg.content;
+			break;
+
+		case "done":
+			state.active = false;
+			state.groups = msg.groups;
+			break;
+
+		case "error":
+			state.active = false;
+			state.error = msg.error;
+			break;
+
+		case "stopped":
+			state.active = false;
+			state.groups = msg.groups;
+			break;
+	}
+}
+
+function applyUpdate(update: AutopilotUIUpdate) {
+	switch (update.type) {
+		case "start":
+			state.maxSteps = update.maxSteps;
+			break;
+		case "end":
+			state.totalSteps = update.totalSteps;
+			state.totalTasks = update.totalTasks;
+			state.duration = update.duration;
+			break;
+		case "text":
+			state.textContent += update.content;
+			break;
+		case "paused":
+			state.paused = true;
+			state.pauseReason = update.reason;
+			break;
+		case "error_event":
+			state.error = update.error;
+			break;
+	}
+}
+
+function handleDetailMessage(e: MessageEvent<DetailWorkerOutgoing>) {
+	const msg = e.data;
+	if (msg.type === "detail") {
+		const cb = detailCallbacks.get(msg.detailToken);
+		if (cb) {
+			cb(msg.content);
+			detailCallbacks.delete(msg.detailToken);
+		}
+	} else if (msg.type === "detail_error") {
+		const cb = detailCallbacks.get(msg.detailToken);
+		if (cb) {
+			cb(null, msg.error);
+			detailCallbacks.delete(msg.detailToken);
+		}
+	}
+}
+
+export function useAutopilot() {
+	return {
+		get state() {
+			return state;
+		},
+
+		async start(url: string, headers: Record<string, string>, body: unknown) {
+			await ensureWorkers();
+			Object.assign(state, { ...defaultState, active: true });
+			autopilotWorker?.postMessage({ type: "start", url, headers, body });
+		},
+
+		stop() {
+			autopilotWorker?.postMessage({ type: "stop" });
+		},
+
+		async fetchDetail(detailToken: string, bridgeUrl: string): Promise<string> {
+			await ensureWorkers();
+			return new Promise((resolve, reject) => {
+				detailCallbacks.set(detailToken, (content, error) => {
+					if (error) reject(new Error(error));
+					else resolve(content!);
+				});
+				detailWorker?.postMessage({ type: "fetch", detailToken, bridgeUrl });
+			});
+		},
+
+		prefetchDetail(detailToken: string, bridgeUrl: string) {
+			detailWorker?.postMessage({ type: "prefetch", detailToken, bridgeUrl });
+		},
+
+		evictDetail(detailToken: string) {
+			detailWorker?.postMessage({ type: "evict", detailToken });
+		},
+
+		destroy() {
+			autopilotWorker?.terminate();
+			detailWorker?.terminate();
+			autopilotWorker = null;
+			detailWorker = null;
+		},
+	};
+}

package/src/ruvocal/src/lib/stores/backgroundGenerations.svelte.ts

@@ -1,32 +1,32 @@
-export type BackgroundGeneration = {
-	id: string;
-	startedAt: number;
-};
-
-export const backgroundGenerationEntries = $state<BackgroundGeneration[]>([]);
-
-export function addBackgroundGeneration(entry: BackgroundGeneration) {
-	const index = backgroundGenerationEntries.findIndex(({ id }) => id === entry.id);
-
-	if (index === -1) {
-		backgroundGenerationEntries.push(entry);
-		return;
-	}
-
-	backgroundGenerationEntries[index] = entry;
-}
-
-export function removeBackgroundGeneration(id: string) {
-	const index = backgroundGenerationEntries.findIndex((entry) => entry.id === id);
-	if (index === -1) return;
-
-	backgroundGenerationEntries.splice(index, 1);
-}
-
-export function clearBackgroundGenerations() {
-	backgroundGenerationEntries.length = 0;
-}
-
-export function hasBackgroundGeneration(id: string) {
-	return backgroundGenerationEntries.some((entry) => entry.id === id);
-}
+export type BackgroundGeneration = {
+	id: string;
+	startedAt: number;
+};
+
+export const backgroundGenerationEntries = $state<BackgroundGeneration[]>([]);
+
+export function addBackgroundGeneration(entry: BackgroundGeneration) {
+	const index = backgroundGenerationEntries.findIndex(({ id }) => id === entry.id);
+
+	if (index === -1) {
+		backgroundGenerationEntries.push(entry);
+		return;
+	}
+
+	backgroundGenerationEntries[index] = entry;
+}
+
+export function removeBackgroundGeneration(id: string) {
+	const index = backgroundGenerationEntries.findIndex((entry) => entry.id === id);
+	if (index === -1) return;
+
+	backgroundGenerationEntries.splice(index, 1);
+}
+
+export function clearBackgroundGenerations() {
+	backgroundGenerationEntries.length = 0;
+}
+
+export function hasBackgroundGeneration(id: string) {
+	return backgroundGenerationEntries.some((entry) => entry.id === id);
+}

package/src/ruvocal/src/lib/stores/backgroundGenerations.ts

@@ -1 +1 @@
-export * from "./backgroundGenerations.svelte";
+export * from "./backgroundGenerations.svelte";

package/src/ruvocal/src/lib/stores/errors.ts

@@ -1,9 +1,9 @@
-import { writable } from "svelte/store";
-
-export const ERROR_MESSAGES = {
-	default: "Oops, something went wrong.",
-	authOnly: "You have to be logged in.",
-	rateLimited: "You are sending too many messages. Try again later.",
-};
-
-export const error = writable<string | undefined>(undefined);
+import { writable } from "svelte/store";
+
+export const ERROR_MESSAGES = {
+	default: "Oops, something went wrong.",
+	authOnly: "You have to be logged in.",
+	rateLimited: "You are sending too many messages. Try again later.",
+};
+
+export const error = writable<string | undefined>(undefined);

package/src/ruvocal/src/lib/stores/isAborted.ts

@@ -1,3 +1,3 @@
-import { writable } from "svelte/store";
-
-export const isAborted = writable<boolean>(false);
+import { writable } from "svelte/store";
+
+export const isAborted = writable<boolean>(false);

package/src/ruvocal/src/lib/stores/isPro.ts

@@ -1,4 +1,4 @@
-import { writable } from "svelte/store";
-
-// null = unknown/loading, true = PRO, false = not PRO
-export const isPro = writable<boolean | null>(null);
+import { writable } from "svelte/store";
+
+// null = unknown/loading, true = PRO, false = not PRO
+export const isPro = writable<boolean | null>(null);