vskill 1.0.16 → 1.0.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +84 -9
- package/agents.json +3 -1
- package/dist/agents/agents-registry.d.ts +61 -0
- package/dist/agents/agents-registry.js +203 -0
- package/dist/agents/agents-registry.js.map +1 -1
- package/dist/api/client.d.ts +85 -0
- package/dist/api/client.js +193 -24
- package/dist/api/client.js.map +1 -1
- package/dist/commands/add-lockfile.d.ts +6 -0
- package/dist/commands/add-lockfile.js +10 -0
- package/dist/commands/add-lockfile.js.map +1 -1
- package/dist/commands/add.d.ts +7 -0
- package/dist/commands/add.js +110 -2
- package/dist/commands/add.js.map +1 -1
- package/dist/commands/auth.d.ts +23 -0
- package/dist/commands/auth.js +105 -11
- package/dist/commands/auth.js.map +1 -1
- package/dist/commands/eval/serve.d.ts +2 -0
- package/dist/commands/eval/serve.js +126 -4
- package/dist/commands/eval/serve.js.map +1 -1
- package/dist/commands/orgs.d.ts +21 -0
- package/dist/commands/orgs.js +164 -0
- package/dist/commands/orgs.js.map +1 -0
- package/dist/commands/skill.js +14 -1
- package/dist/commands/skill.js.map +1 -1
- package/dist/commands/whoami.d.ts +29 -0
- package/dist/commands/whoami.js +119 -0
- package/dist/commands/whoami.js.map +1 -0
- package/dist/discovery/github-tree.d.ts +23 -3
- package/dist/discovery/github-tree.js +172 -24
- package/dist/discovery/github-tree.js.map +1 -1
- package/dist/eval/anthropic-catalog.js +32 -2
- package/dist/eval/anthropic-catalog.js.map +1 -1
- package/dist/eval/batch-judge.js +1 -0
- package/dist/eval/batch-judge.js.map +1 -1
- package/dist/eval/llm.d.ts +1 -1
- package/dist/eval/llm.js +104 -2
- package/dist/eval/llm.js.map +1 -1
- package/dist/eval-server/__tests__/helpers/studio-token-test-helpers.d.ts +2 -0
- package/dist/eval-server/__tests__/helpers/studio-token-test-helpers.js +20 -0
- package/dist/eval-server/__tests__/helpers/studio-token-test-helpers.js.map +1 -0
- package/dist/eval-server/active-tenant-routes.d.ts +15 -0
- package/dist/eval-server/active-tenant-routes.js +101 -0
- package/dist/eval-server/active-tenant-routes.js.map +1 -0
- package/dist/eval-server/api-routes.js +17 -2
- package/dist/eval-server/api-routes.js.map +1 -1
- package/dist/eval-server/desktop-open-routes.d.ts +8 -0
- package/dist/eval-server/desktop-open-routes.js +64 -0
- package/dist/eval-server/desktop-open-routes.js.map +1 -0
- package/dist/eval-server/eval-server.js +82 -5
- package/dist/eval-server/eval-server.js.map +1 -1
- package/dist/eval-server/export-skill-routes.d.ts +9 -0
- package/dist/eval-server/export-skill-routes.js +81 -0
- package/dist/eval-server/export-skill-routes.js.map +1 -0
- package/dist/eval-server/git-routes.d.ts +1 -0
- package/dist/eval-server/git-routes.js +101 -4
- package/dist/eval-server/git-routes.js.map +1 -1
- package/dist/eval-server/install-engine-routes.d.ts +3 -16
- package/dist/eval-server/install-engine-routes.js +9 -124
- package/dist/eval-server/install-engine-routes.js.map +1 -1
- package/dist/eval-server/install-jobs.d.ts +41 -0
- package/dist/eval-server/install-jobs.js +161 -0
- package/dist/eval-server/install-jobs.js.map +1 -0
- package/dist/eval-server/install-skill-routes.d.ts +74 -11
- package/dist/eval-server/install-skill-routes.js +506 -79
- package/dist/eval-server/install-skill-routes.js.map +1 -1
- package/dist/eval-server/install-state-routes.d.ts +4 -0
- package/dist/eval-server/install-state-routes.js +15 -1
- package/dist/eval-server/install-state-routes.js.map +1 -1
- package/dist/eval-server/oauth-github-routes.d.ts +2 -0
- package/dist/eval-server/oauth-github-routes.js +505 -0
- package/dist/eval-server/oauth-github-routes.js.map +1 -0
- package/dist/eval-server/platform-proxy.d.ts +17 -1
- package/dist/eval-server/platform-proxy.js +125 -13
- package/dist/eval-server/platform-proxy.js.map +1 -1
- package/dist/eval-server/plugin-cli-routes.js +9 -9
- package/dist/eval-server/plugin-cli-routes.js.map +1 -1
- package/dist/eval-server/remove-skill-routes.d.ts +18 -0
- package/dist/eval-server/remove-skill-routes.js +145 -0
- package/dist/eval-server/remove-skill-routes.js.map +1 -0
- package/dist/eval-server/router.d.ts +17 -3
- package/dist/eval-server/router.js +166 -9
- package/dist/eval-server/router.js.map +1 -1
- package/dist/eval-server/settings-store.js +1 -1
- package/dist/eval-server/settings-store.js.map +1 -1
- package/dist/eval-server/supported-agents-routes.d.ts +6 -0
- package/dist/eval-server/supported-agents-routes.js +41 -0
- package/dist/eval-server/supported-agents-routes.js.map +1 -0
- package/dist/eval-server/utils/spawn-env.d.ts +1 -0
- package/dist/eval-server/utils/spawn-env.js +47 -0
- package/dist/eval-server/utils/spawn-env.js.map +1 -0
- package/dist/eval-ui/assets/AdvancedTab-D8zbE5fH.js +1 -0
- package/dist/eval-ui/assets/{CreateSkillPage-CvdYq8Rr.js → CreateSkillPage-DOBhKdgr.js} +5 -5
- package/dist/eval-ui/assets/FindSkillsPalette-CyMmNPr-.js +2 -0
- package/dist/eval-ui/assets/GeneralTab-DYR9NWC4.js +1 -0
- package/dist/eval-ui/assets/PrivacyTab-CXIqQokl.js +1 -0
- package/dist/eval-ui/assets/{SearchPaletteCore-Bf3PBC64.js → SearchPaletteCore-Dn5gQJS_.js} +2 -2
- package/dist/eval-ui/assets/SkillDetailPanel-DTrRnyyJ.js +1 -0
- package/dist/eval-ui/assets/UpdateDropdown-Cvr2fe0z.js +1 -0
- package/dist/eval-ui/assets/UpdatesTab-DwJIUDPX.js +1 -0
- package/dist/eval-ui/assets/core-DZAvsxlC.js +1 -0
- package/dist/eval-ui/assets/event-CDYWU2X3.js +1 -0
- package/dist/eval-ui/assets/globals-BRZwPAPF.js +49 -0
- package/dist/eval-ui/assets/globals-C3oEdsJh.css +1 -0
- package/dist/eval-ui/assets/index-D7M0Jdss.js +1 -0
- package/dist/eval-ui/assets/lifecycle-DSleOV-l.js +1 -0
- package/dist/eval-ui/assets/lifecycle-d1Sm9Hts.css +1 -0
- package/dist/eval-ui/assets/main-D2shn1dH.js +87 -0
- package/dist/eval-ui/assets/preferences-BHZXB5dL.css +1 -0
- package/dist/eval-ui/assets/preferences-BKv6X7fK.js +2 -0
- package/dist/eval-ui/assets/useDesktopBridge-DxVWbYqK.js +2 -0
- package/dist/eval-ui/index.html +4 -2
- package/dist/eval-ui/lifecycle.html +33 -0
- package/dist/eval-ui/preferences.html +34 -0
- package/dist/index.js +47 -1
- package/dist/index.js.map +1 -1
- package/dist/installer/bundle-files.d.ts +4 -0
- package/dist/installer/bundle-files.js +97 -0
- package/dist/installer/bundle-files.js.map +1 -0
- package/dist/installer/canonical.d.ts +31 -6
- package/dist/installer/canonical.js +48 -12
- package/dist/installer/canonical.js.map +1 -1
- package/dist/installer/clipboard-export.d.ts +19 -0
- package/dist/installer/clipboard-export.js +88 -0
- package/dist/installer/clipboard-export.js.map +1 -0
- package/dist/installer/multi-install.d.ts +43 -0
- package/dist/installer/multi-install.js +237 -0
- package/dist/installer/multi-install.js.map +1 -0
- package/dist/installer/transformers/aider.d.ts +2 -0
- package/dist/installer/transformers/aider.js +32 -0
- package/dist/installer/transformers/aider.js.map +1 -0
- package/dist/installer/transformers/continue-dev.d.ts +2 -0
- package/dist/installer/transformers/continue-dev.js +6 -0
- package/dist/installer/transformers/continue-dev.js.map +1 -0
- package/dist/installer/transformers/cursor.d.ts +2 -0
- package/dist/installer/transformers/cursor.js +24 -0
- package/dist/installer/transformers/cursor.js.map +1 -0
- package/dist/installer/transformers/github-copilot.d.ts +2 -0
- package/dist/installer/transformers/github-copilot.js +17 -0
- package/dist/installer/transformers/github-copilot.js.map +1 -0
- package/dist/installer/transformers/index.d.ts +78 -0
- package/dist/installer/transformers/index.js +13 -0
- package/dist/installer/transformers/index.js.map +1 -0
- package/dist/installer/transformers/junie.d.ts +2 -0
- package/dist/installer/transformers/junie.js +6 -0
- package/dist/installer/transformers/junie.js.map +1 -0
- package/dist/installer/transformers/kiro.d.ts +2 -0
- package/dist/installer/transformers/kiro.js +6 -0
- package/dist/installer/transformers/kiro.js.map +1 -0
- package/dist/installer/transformers/trae.d.ts +2 -0
- package/dist/installer/transformers/trae.js +6 -0
- package/dist/installer/transformers/trae.js.map +1 -0
- package/dist/installer/transformers/windsurf.d.ts +2 -0
- package/dist/installer/transformers/windsurf.js +12 -0
- package/dist/installer/transformers/windsurf.js.map +1 -0
- package/dist/installer/yaml-safe-mutate.d.ts +19 -0
- package/dist/installer/yaml-safe-mutate.js +184 -0
- package/dist/installer/yaml-safe-mutate.js.map +1 -0
- package/dist/lib/active-tenant.d.ts +36 -0
- package/dist/lib/active-tenant.js +120 -0
- package/dist/lib/active-tenant.js.map +1 -0
- package/dist/lib/github-fetch.d.ts +1 -0
- package/dist/lib/github-fetch.js +11 -1
- package/dist/lib/github-fetch.js.map +1 -1
- package/dist/lib/keychain.d.ts +15 -2
- package/dist/lib/keychain.js +156 -8
- package/dist/lib/keychain.js.map +1 -1
- package/dist/lib/migration/keychain-migration.d.ts +35 -0
- package/dist/lib/migration/keychain-migration.js +189 -0
- package/dist/lib/migration/keychain-migration.js.map +1 -0
- package/dist/lib/tenant-resolver.d.ts +38 -0
- package/dist/lib/tenant-resolver.js +79 -0
- package/dist/lib/tenant-resolver.js.map +1 -0
- package/dist/lockfile/types.d.ts +8 -0
- package/dist/sidecar/eval-ui-manifest.json +1 -0
- package/dist/sidecar/sea-config.json +57 -0
- package/dist/sidecar/sea-prep.blob +0 -0
- package/dist/sidecar/server.cjs +141627 -0
- package/dist/sidecar/vskill-version.txt +1 -0
- package/dist/studio/lib/ops-log.js +140 -57
- package/dist/studio/lib/ops-log.js.map +1 -1
- package/dist/studio/lib/scope-transfer.d.ts +11 -1
- package/dist/studio/lib/scope-transfer.js +48 -24
- package/dist/studio/lib/scope-transfer.js.map +1 -1
- package/dist/studio/routes/index.js +10 -1
- package/dist/studio/routes/index.js.map +1 -1
- package/dist/studio/routes/ops.js +31 -7
- package/dist/studio/routes/ops.js.map +1 -1
- package/dist/studio/routes/promote.js +15 -8
- package/dist/studio/routes/promote.js.map +1 -1
- package/dist/studio/routes/revert.js +12 -1
- package/dist/studio/routes/revert.js.map +1 -1
- package/dist/studio/routes/test-install.js +13 -8
- package/dist/studio/routes/test-install.js.map +1 -1
- package/dist/studio-runtime/lockfile.d.ts +51 -0
- package/dist/studio-runtime/lockfile.js +216 -0
- package/dist/studio-runtime/lockfile.js.map +1 -0
- package/dist/updater/source-fetcher.js +2 -2
- package/dist/updater/source-fetcher.js.map +1 -1
- package/package.json +17 -1
- package/dist/eval-ui/assets/FindSkillsPalette-DsSgotS9.js +0 -2
- package/dist/eval-ui/assets/SkillDetailPanel-DAD2yJO-.js +0 -1
- package/dist/eval-ui/assets/UpdateDropdown-h5Hg3h7Z.js +0 -1
- package/dist/eval-ui/assets/index-CKLqBL52.css +0 -1
- package/dist/eval-ui/assets/index-JaDg6FlU.js +0 -124
- package/dist/eval-ui/assets/skill-studio-logo-CRyKgIrg.png +0 -0
|
@@ -10,7 +10,21 @@ export declare class Router {
|
|
|
10
10
|
private addRoute;
|
|
11
11
|
handle(req: http.IncomingMessage, res: http.ServerResponse): Promise<boolean>;
|
|
12
12
|
}
|
|
13
|
-
/**
|
|
14
|
-
|
|
15
|
-
|
|
13
|
+
/**
|
|
14
|
+
* Lazily generate (or return) the per-process studio token. 32 bytes of
|
|
15
|
+
* `crypto.randomBytes` encoded as base64url — 256 bits of entropy, 43 chars,
|
|
16
|
+
* URL-safe and header-safe. Never persisted; rotated on every restart.
|
|
17
|
+
*/
|
|
18
|
+
export declare function getStudioToken(): string;
|
|
19
|
+
/** Test-only — never call from production code. */
|
|
20
|
+
export declare function _resetStudioTokenForTests(): void;
|
|
21
|
+
/**
|
|
22
|
+
* Constant-time token comparison. `crypto.timingSafeEqual` requires equal-
|
|
23
|
+
* length buffers; we length-check first (the token length is a public
|
|
24
|
+
* constant, so the early return leaks no secret). String === would be V8
|
|
25
|
+
* short-circuit and timing-leaky.
|
|
26
|
+
*/
|
|
27
|
+
export declare function tokensEqual(supplied: string | undefined | null, expected: string): boolean;
|
|
28
|
+
export declare function tokenGate(req: http.IncomingMessage, res: http.ServerResponse): boolean;
|
|
29
|
+
export declare function sendJson(res: http.ServerResponse, data: unknown, status?: number, _req?: http.IncomingMessage): void;
|
|
16
30
|
export declare function readBody(req: http.IncomingMessage): Promise<unknown>;
|
|
@@ -1,6 +1,14 @@
|
|
|
1
1
|
// ---------------------------------------------------------------------------
|
|
2
2
|
// router.ts -- minimal HTTP router adapted from specweave dashboard pattern
|
|
3
|
+
//
|
|
4
|
+
// 0836 US-002: every /api/* request requires `X-Studio-Token`. The token is
|
|
5
|
+
// generated lazily per process and exposed to the Tauri WebView via the
|
|
6
|
+
// `get_studio_token` IPC. The previous LOCALHOST_ORIGIN_RE allowlist was
|
|
7
|
+
// permissive (any localhost browser tab + DNS rebinding). Replaced with a
|
|
8
|
+
// per-launch shared-secret gate using `crypto.timingSafeEqual` (constant
|
|
9
|
+
// time over equal-length buffers, length-mismatch fast-rejected).
|
|
3
10
|
// ---------------------------------------------------------------------------
|
|
11
|
+
import { randomBytes, timingSafeEqual } from "node:crypto";
|
|
4
12
|
export class Router {
|
|
5
13
|
routes = [];
|
|
6
14
|
options;
|
|
@@ -33,6 +41,14 @@ export class Router {
|
|
|
33
41
|
const method = req.method || "GET";
|
|
34
42
|
const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
|
|
35
43
|
const pathname = url.pathname;
|
|
44
|
+
// 0836 US-002: gate every /api/* request behind the X-Studio-Token. The
|
|
45
|
+
// gate writes 401 + empty body on failure; we return `true` so the
|
|
46
|
+
// server.ts dispatcher treats the response as owned and stops looking
|
|
47
|
+
// for static-file fallbacks (which would otherwise serve index.html
|
|
48
|
+
// for unmatched paths and confuse callers).
|
|
49
|
+
if (!tokenGate(req, res)) {
|
|
50
|
+
return true;
|
|
51
|
+
}
|
|
36
52
|
for (const route of this.routes) {
|
|
37
53
|
if (route.method !== method)
|
|
38
54
|
continue;
|
|
@@ -59,20 +75,161 @@ export class Router {
|
|
|
59
75
|
return false;
|
|
60
76
|
}
|
|
61
77
|
}
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
78
|
+
// ---------------------------------------------------------------------------
|
|
79
|
+
// 0836 US-002 — X-Studio-Token (per-launch shared secret).
|
|
80
|
+
//
|
|
81
|
+
// The previous `LOCALHOST_ORIGIN_RE` allowlist was permissive (any tab on
|
|
82
|
+
// `http://localhost:*` could reach the bearer-injecting proxy, and DNS
|
|
83
|
+
// rebinding subverted it). It is REMOVED. Each /api/* request must now
|
|
84
|
+
// carry `X-Studio-Token: <token>`; the token lives only in the eval-server
|
|
85
|
+
// process memory and is delivered to the Tauri WebView via IPC and to the
|
|
86
|
+
// CLI via stdout banner.
|
|
87
|
+
// ---------------------------------------------------------------------------
|
|
88
|
+
let _studioToken = null;
|
|
89
|
+
/**
|
|
90
|
+
* Lazily generate (or return) the per-process studio token. 32 bytes of
|
|
91
|
+
* `crypto.randomBytes` encoded as base64url — 256 bits of entropy, 43 chars,
|
|
92
|
+
* URL-safe and header-safe. Never persisted; rotated on every restart.
|
|
93
|
+
*/
|
|
94
|
+
export function getStudioToken() {
|
|
95
|
+
if (_studioToken == null) {
|
|
96
|
+
_studioToken = randomBytes(32).toString("base64url");
|
|
97
|
+
}
|
|
98
|
+
return _studioToken;
|
|
99
|
+
}
|
|
100
|
+
/** Test-only — never call from production code. */
|
|
101
|
+
export function _resetStudioTokenForTests() {
|
|
102
|
+
_studioToken = null;
|
|
103
|
+
}
|
|
104
|
+
/**
|
|
105
|
+
* Constant-time token comparison. `crypto.timingSafeEqual` requires equal-
|
|
106
|
+
* length buffers; we length-check first (the token length is a public
|
|
107
|
+
* constant, so the early return leaks no secret). String === would be V8
|
|
108
|
+
* short-circuit and timing-leaky.
|
|
109
|
+
*/
|
|
110
|
+
export function tokensEqual(supplied, expected) {
|
|
111
|
+
if (typeof supplied !== "string")
|
|
112
|
+
return false;
|
|
113
|
+
if (supplied.length !== expected.length)
|
|
114
|
+
return false;
|
|
115
|
+
const a = Buffer.from(supplied);
|
|
116
|
+
const b = Buffer.from(expected);
|
|
117
|
+
return timingSafeEqual(a, b);
|
|
118
|
+
}
|
|
119
|
+
/**
|
|
120
|
+
* Returns true when the request is allowed to proceed. Returns false AND
|
|
121
|
+
* writes a 401 (empty body) when the gate rejects.
|
|
122
|
+
*
|
|
123
|
+
* Bypasses:
|
|
124
|
+
* - any non-/api/* path (static files, root, eval-ui shell)
|
|
125
|
+
* - OPTIONS preflight (CORS handshake; no token possible from XHR)
|
|
126
|
+
*/
|
|
127
|
+
// 0855: GET EventSource stream paths that the browser opens via `new
|
|
128
|
+
// EventSource(url)`. The EventSource API CANNOT set request headers, so these
|
|
129
|
+
// streams authenticate via a `?studioToken=<t>` query param instead of the
|
|
130
|
+
// `X-Studio-Token` header — validated with the same timing-safe compare. The
|
|
131
|
+
// exemption is GET-only and limited to this allowlist so it cannot widen the
|
|
132
|
+
// 0836 gate for any other path or method.
|
|
133
|
+
// - /api/v1/skills/stream — notification stream (proxied to the platform
|
|
134
|
+
// UpdateHub). This is the one that 0836 silently broke (no live toasts).
|
|
135
|
+
// - /api/events / /api/studio/ops/stream — local eval-server SSE streams
|
|
136
|
+
// opened by EventSource; same header-less limitation applies.
|
|
137
|
+
const EVENTSOURCE_STREAM_PATHS = new Set([
|
|
138
|
+
"/api/v1/skills/stream",
|
|
139
|
+
"/api/events",
|
|
140
|
+
"/api/studio/ops/stream",
|
|
141
|
+
]);
|
|
142
|
+
export function tokenGate(req, res) {
|
|
143
|
+
const rawUrl = req.url || "/";
|
|
144
|
+
// 0836 followup (Codex H#4): normalize req.url through URL parsing so that
|
|
145
|
+
// an absolute-form request target (e.g. `GET http://127.0.0.1:3077/api/git/status`)
|
|
146
|
+
// gates by its parsed pathname, not by the raw string. Without this,
|
|
147
|
+
// `rawUrl.startsWith("/api/")` returns false for absolute-form URLs and
|
|
148
|
+
// the router's pathname-based dispatch happily executes the route.
|
|
149
|
+
let parsedUrl;
|
|
150
|
+
try {
|
|
151
|
+
parsedUrl = new URL(rawUrl, "http://127.0.0.1");
|
|
152
|
+
}
|
|
153
|
+
catch {
|
|
154
|
+
// Truly malformed URL — let the underlying handlers reject it.
|
|
155
|
+
return true;
|
|
156
|
+
}
|
|
157
|
+
const pathname = parsedUrl.pathname;
|
|
158
|
+
const method = (req.method || "GET").toUpperCase();
|
|
159
|
+
// Non-/api paths are static / SPA shell — never gated.
|
|
160
|
+
if (!pathname.startsWith("/api/"))
|
|
161
|
+
return true;
|
|
162
|
+
// CORS preflight cannot send custom headers; let it pass.
|
|
163
|
+
if (method === "OPTIONS")
|
|
164
|
+
return true;
|
|
165
|
+
// 0836 followup (Codex C#1): /api/health is the unauthenticated liveness
|
|
166
|
+
// probe used by the desktop sidecar boot. The Tauri shell calls it BEFORE
|
|
167
|
+
// it has parsed the studio_token from the sidecar's stdout, so token-gating
|
|
168
|
+
// it would deadlock the chicken-and-egg: the token comes from the running
|
|
169
|
+
// server, but the server has to be reachable to deliver it. Loopback bind
|
|
170
|
+
// (US-001) is the network-level guard for /api/health.
|
|
171
|
+
if (pathname === "/api/health")
|
|
172
|
+
return true;
|
|
173
|
+
// 0843 followup (2026-05-11): the GitHub OAuth browser callbacks are hit by
|
|
174
|
+
// the user's browser AFTER they authorize at github.com — there's no way
|
|
175
|
+
// for those requests to carry X-Studio-Token. The endpoints themselves are
|
|
176
|
+
// CSRF-protected via the `state` param (validated against an in-memory
|
|
177
|
+
// per-flow store), so exempting them from the token gate is safe.
|
|
178
|
+
if (pathname === "/api/oauth/github/callback")
|
|
179
|
+
return true;
|
|
180
|
+
if (pathname === "/api/oauth/github/desktop-complete")
|
|
181
|
+
return true;
|
|
182
|
+
const expected = getStudioToken();
|
|
183
|
+
// 0855: EventSource streams carry the token in a `?studioToken=<t>` query
|
|
184
|
+
// param because the browser EventSource API cannot set request headers.
|
|
185
|
+
// Scope: GET only + an allowlist of known stream paths. Validate with the
|
|
186
|
+
// SAME timing-safe compare used for the header. On success, STRIP the
|
|
187
|
+
// studioToken param from req.url BEFORE returning so it never reaches the
|
|
188
|
+
// upstream platform proxy (which reads req.url after the gate) and never
|
|
189
|
+
// leaks to verified-skill.com. The token is never logged.
|
|
190
|
+
if (method === "GET" && EVENTSOURCE_STREAM_PATHS.has(pathname)) {
|
|
191
|
+
const qpToken = parsedUrl.searchParams.get("studioToken");
|
|
192
|
+
if (tokensEqual(qpToken, expected)) {
|
|
193
|
+
parsedUrl.searchParams.delete("studioToken");
|
|
194
|
+
req.url = `${parsedUrl.pathname}${parsedUrl.search}`;
|
|
195
|
+
return true;
|
|
196
|
+
}
|
|
197
|
+
// Wrong/missing query token falls through to the header check below; if
|
|
198
|
+
// that also fails the request is rejected (boundary preserved).
|
|
199
|
+
}
|
|
200
|
+
const supplied = readHeader(req, "x-studio-token");
|
|
201
|
+
if (tokensEqual(supplied, expected))
|
|
202
|
+
return true;
|
|
203
|
+
// Reject. Empty body avoids leaking the expected-length info beyond what
|
|
204
|
+
// a fixed 401 signals. Log at WARN — and crucially WITHOUT the supplied
|
|
205
|
+
// token value (a wrong-length attempt could still be sensitive in CI logs).
|
|
206
|
+
// We log the path + method only.
|
|
207
|
+
if (!res.headersSent) {
|
|
208
|
+
res.writeHead(401, { "Content-Type": "text/plain" });
|
|
209
|
+
res.end("");
|
|
210
|
+
}
|
|
211
|
+
// eslint-disable-next-line no-console
|
|
212
|
+
console.warn(`[router] X-Studio-Token rejected for ${method} ${pathname}`);
|
|
213
|
+
return false;
|
|
214
|
+
}
|
|
215
|
+
function readHeader(req, name) {
|
|
216
|
+
const v = req.headers[name];
|
|
217
|
+
if (typeof v === "string")
|
|
218
|
+
return v;
|
|
219
|
+
if (Array.isArray(v))
|
|
220
|
+
return v[0];
|
|
221
|
+
return undefined;
|
|
222
|
+
}
|
|
223
|
+
export function sendJson(res, data, status = 200, _req) {
|
|
224
|
+
// 0836 US-002: CORS Origin-allowlist deleted. The studio-token gate is the
|
|
225
|
+
// sole authn for /api/*; any caller that passes the gate is same-origin
|
|
226
|
+
// for our purposes (Tauri WebView, vskill CLI's curl, Playwright, dev).
|
|
227
|
+
// We do not echo Access-Control-Allow-* headers anymore.
|
|
65
228
|
const headers = {
|
|
66
229
|
"Content-Type": "application/json",
|
|
67
230
|
"Cache-Control": "no-store",
|
|
68
231
|
Vary: "Origin",
|
|
69
232
|
};
|
|
70
|
-
const origin = req?.headers?.origin;
|
|
71
|
-
if (origin && LOCALHOST_ORIGIN_RE.test(origin)) {
|
|
72
|
-
headers["Access-Control-Allow-Origin"] = origin;
|
|
73
|
-
headers["Access-Control-Allow-Methods"] = "GET, POST, PUT, DELETE, OPTIONS";
|
|
74
|
-
headers["Access-Control-Allow-Headers"] = "Content-Type";
|
|
75
|
-
}
|
|
76
233
|
res.writeHead(status, headers);
|
|
77
234
|
res.end(JSON.stringify(data));
|
|
78
235
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/eval-server/router.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;
|
|
1
|
+
{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/eval-server/router.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,kEAAkE;AAClE,8EAA8E;AAG9E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAe3D,MAAM,OAAO,MAAM;IACT,MAAM,GAAY,EAAE,CAAC;IAC7B,OAAO,CAAiE;IAExE,GAAG,CAAC,IAAY,EAAE,OAAqB;QACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,OAAqB;QACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,GAAG,CAAC,IAAY,EAAE,OAAqB;QACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,OAAqB;QACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,OAAqB;QAClE,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACpD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,MAAM;YACN,OAAO,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC;YACnC,UAAU;YACV,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAyB,EAAE,GAAwB;QAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE9B,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,oEAAoE;QACpE,4CAA4C;QAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;oBAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;oBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,yBAAyB;AACzB,8EAA8E;AAE9E,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,yBAAyB;IACvC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,QAAmC,EACnC,QAAgB;IAEhB,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,qEAAqE;AACrE,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,0CAA0C;AAC1C,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS;IAC/C,uBAAuB;IACvB,aAAa;IACb,wBAAwB;CACzB,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CACvB,GAAyB,EACzB,GAAwB;IAExB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAC9B,2EAA2E;IAC3E,oFAAoF;IACpF,qEAAqE;IACrE,wEAAwE;IACxE,mEAAmE;IACnE,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,uDAAuD;IACvD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,0DAA0D;IAC1D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC5C,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,QAAQ,KAAK,4BAA4B;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,QAAQ,KAAK,oCAAoC;QAAE,OAAO,IAAI,CAAC;IAEnE,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAElC,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,MAAM,KAAK,KAAK,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC7C,GAAG,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,wEAAwE;QACxE,gEAAgE;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnD,IAAI,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,iCAAiC;IACjC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,wCAAwC,MAAM,IAAI,QAAQ,EAAE,CAC7D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CACjB,GAAyB,EACzB,IAAY;IAEZ,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,GAAwB,EACxB,IAAa,EACb,MAAM,GAAG,GAAG,EACZ,IAA2B;IAE3B,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU;QAC3B,IAAI,EAAE,QAAQ;KACf,CAAC;IACF,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAyB;IACtD,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC5C,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// ---------------------------------------------------------------------------
|
|
2
|
-
// settings-store.ts — File-backed credential store for
|
|
2
|
+
// settings-store.ts — File-backed credential store for Skill Studio.
|
|
3
3
|
//
|
|
4
4
|
// Single on-disk file at `<configDir>/keys.env` (default configDir:
|
|
5
5
|
// `~/.vskill`, overridable via VSKILL_CONFIG_DIR). KEY=VALUE dotenv format.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"settings-store.js","sourceRoot":"","sources":["../../src/eval-server/settings-store.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,
|
|
1
|
+
{"version":3,"file":"settings-store.js","sourceRoot":"","sources":["../../src/eval-server/settings-store.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,mEAAmE;AACnE,EAAE;AACF,YAAY;AACZ,yEAAyE;AACzE,iEAAiE;AACjE,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,uEAAuE;AACvE,4EAA4E;AAC5E,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAE9E,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,SAAS,GAGV,MAAM,gBAAgB,CAAC;AAqCxB,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E,MAAM,aAAa,GAAW;IAC5B,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/B,CAAC;AAEF,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,MAAM,SAAS,GAAa;IAC1B,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAI,IAAgD,CAAC;IACtG,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAI,IAA6C,CAAC;IAC7F,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAI,IAA4C,CAAC;IAC1F,YAAY,EAAE,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE,CACnC,MAAM,CAAC,YAAwD,CAAC,GAAG,IAAI,CAAC,CAA+B;IAC1G,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAI,IAA6C,CAAC;IAC7F,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAI,IAA6C,CAAC;IAC7F,SAAS,EAAE,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE,CAChC,MAAM,CAAC,SAAqD,CAAC,GAAG,IAAI,CAAC,CAA4B;IACpG,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE,CAC/B,MAAM,CAAC,QAAoD,CAAC,GAAG,IAAI,CAAC,CAA2B;CACnG,CAAC;AAEF,IAAI,MAAM,GAAW,aAAa,CAAC;AACnC,IAAI,MAAM,GAAa,SAAS,CAAC;AACjC,IAAI,iBAAiB,GAAkB,IAAI,CAAC;AAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;AAC/C,8DAA8D;AAC9D,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;AAChD,4EAA4E;AAC5E,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAqC,CAAC;AACjE,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,gBAAgB;IACvB,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9C,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,SAAS,SAAS,CAAC,QAAgB;IAIjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,aAAa;IACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAC3C,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACZ,cAAc,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5C,cAAc,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,8DAA8D;gBAC9D,kDAAkD;gBAClD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC,QAAkB,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,oBAAoB,cAAc,yBAAyB,QAAQ,eAAe,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,mCAAmC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,SAAS,SAAS,CAAC,OAA+B;IAChD,MAAM,KAAK,GAAa;QACtB,0FAA0F;KAC3F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2BAA2B;QAC3B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAAoB,EACpB,GAAW;IAEX,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,YAAY,EAAE,CAAC;IAEf,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kDAAkD;QAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CACV,4BAA4B,QAAQ,KAAK,QAAQ,aAAc,GAAa,CAAC,OAAO,EAAE,CACvF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,WAAW,QAAQ,KAAK,QAAQ,aAAc,GAAa,CAAC,OAAO,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5C,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAoB;IAC1C,YAAY,EAAE,CAAC;IACf,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CACS,CAAC;IACpC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAoB;IAC9C,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAoB;IAC7C,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAoB;IAClD,YAAY,EAAE,CAAC;IACf,yEAAyE;IACzE,wEAAwE;IACxE,2DAA2D;IAC3D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,8BAA8B,QAAQ,aAAc,GAAa,CAAC,OAAO,EAAE,CAC5E,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,0EAA0E;IAC1E,sEAAsE;IACtE,iDAAiD;IACjD,mEAAmE;IACnE,sEAAsE;IACtE,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IAC5D,IAAI,UAAU,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1C,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,YAAY,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,CAAa,EAAe,EAAE;QAC1C,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5C,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;QAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;QACtB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,UAAU,sBAAsB;IACpC,YAAY,EAAE,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,gDAAgD;QAChD,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;YACtC,oEAAoE;YACpE,gEAAgE;YAChE,sDAAsD;YACtD,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;QACD,qEAAqE;QACrE,gDAAgD;QAChD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,+BAA+B;IAC/B,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAYD,MAAM,UAAU,kBAAkB,CAAC,OAAqB,EAAE;IACxD,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAC9B,MAAM,GAAG,KAAK,CAAC;IACf,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IACtC,MAAM,GAAG,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;IAC9B,iBAAiB,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;AAC7C,CAAC"}
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
// 0845 T-005 — GET /api/studio/supported-agents
|
|
2
|
+
//
|
|
3
|
+
// Returns every agent the Studio knows how to install to — Tier 1/2
|
|
4
|
+
// (filesystem) and Tier 3 (clipboard) — regardless of binary detection.
|
|
5
|
+
// Drives the Cross-tool Install Targets modal (US-001, US-002).
|
|
6
|
+
//
|
|
7
|
+
// Design decisions (see plan.md §1 D1 + ADR-0845-01):
|
|
8
|
+
// - Distinct from /api/studio/install-state's detectedAgentTools list,
|
|
9
|
+
// which only surfaces detected binaries. This new endpoint includes
|
|
10
|
+
// undetected agents so users can install to tools whose CLI isn't on
|
|
11
|
+
// $PATH (e.g. Codex on a machine where the binary is at a non-standard
|
|
12
|
+
// path, or Antigravity which has no CLI binary).
|
|
13
|
+
// - Detection probes run in parallel (Promise.allSettled inside
|
|
14
|
+
// getSupportedAgents) so latency is bounded by the slowest probe, not
|
|
15
|
+
// the sum (AC-US6-02).
|
|
16
|
+
// - Localhost-only — mirrors install-state-routes.ts:54-58 / install-jobs.ts:51.
|
|
17
|
+
// - No SAFE_NAME guard needed: this endpoint takes no user input.
|
|
18
|
+
import { sendJson } from "./router.js";
|
|
19
|
+
import { getSupportedAgents } from "../agents/agents-registry.js";
|
|
20
|
+
function isLocalhost(req) {
|
|
21
|
+
const addr = req.socket.remoteAddress ?? "";
|
|
22
|
+
return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
|
|
23
|
+
}
|
|
24
|
+
export function registerSupportedAgentsRoutes(router) {
|
|
25
|
+
router.get("/api/studio/supported-agents", async (req, res) => {
|
|
26
|
+
if (!isLocalhost(req)) {
|
|
27
|
+
sendJson(res, { error: "localhost-only endpoint" }, 403, req);
|
|
28
|
+
return;
|
|
29
|
+
}
|
|
30
|
+
try {
|
|
31
|
+
const agents = await getSupportedAgents();
|
|
32
|
+
const body = { agents };
|
|
33
|
+
sendJson(res, body, 200, req);
|
|
34
|
+
}
|
|
35
|
+
catch (err) {
|
|
36
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
37
|
+
sendJson(res, { error: "supported-agents-probe-failed", detail: message }, 500, req);
|
|
38
|
+
}
|
|
39
|
+
});
|
|
40
|
+
}
|
|
41
|
+
//# sourceMappingURL=supported-agents-routes.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"supported-agents-routes.js","sourceRoot":"","sources":["../../src/eval-server/supported-agents-routes.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,gEAAgE;AAChE,EAAE;AACF,sDAAsD;AACtD,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,qDAAqD;AACrD,kEAAkE;AAClE,0EAA0E;AAC1E,2BAA2B;AAC3B,mFAAmF;AACnF,oEAAoE;AAKpE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAuB,MAAM,8BAA8B,CAAC;AAMvF,SAAS,WAAW,CAAC,GAAyB;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IAC5C,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,kBAAkB,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,CAAC,GAAG,CACR,8BAA8B,EAC9B,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAE,EAAE;QAC5D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,CAAC;YACjD,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,QAAQ,CACN,GAAG,EACH,EAAE,KAAK,EAAE,+BAA+B,EAAE,MAAM,EAAE,OAAO,EAAE,EAC3D,GAAG,EACH,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export declare function buildSpawnEnv(extra?: Record<string, string | undefined>): NodeJS.ProcessEnv;
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
// ---------------------------------------------------------------------------
|
|
2
|
+
// spawn-env — minimal env passed to install-spawn child processes.
|
|
3
|
+
// ---------------------------------------------------------------------------
|
|
4
|
+
// `child_process.spawn` inherits the parent's full env by default. The
|
|
5
|
+
// studio process is loaded with provider API keys (ANTHROPIC_API_KEY,
|
|
6
|
+
// OPENAI_API_KEY, OPENROUTER_API_KEY etc.) populated by boot-preflight, plus
|
|
7
|
+
// VSKILL_PLATFORM_URL overrides and any other developer-shell env. None of
|
|
8
|
+
// that is needed by `vskill install` or `claude plugin install`, and leaking
|
|
9
|
+
// keys to spawned subprocesses widens the secret blast radius for no gain.
|
|
10
|
+
//
|
|
11
|
+
// We pass the smallest set that real installers need: PATH, HOME, USER,
|
|
12
|
+
// SHELL, plus locale + tmpdir vars. Anything else (registry overrides etc.)
|
|
13
|
+
// must be added explicitly by the caller.
|
|
14
|
+
// ---------------------------------------------------------------------------
|
|
15
|
+
const DEFAULT_PASSTHROUGH_KEYS = [
|
|
16
|
+
"PATH",
|
|
17
|
+
"HOME",
|
|
18
|
+
"USER",
|
|
19
|
+
"USERNAME",
|
|
20
|
+
"LOGNAME",
|
|
21
|
+
"SHELL",
|
|
22
|
+
"LANG",
|
|
23
|
+
"LC_ALL",
|
|
24
|
+
"LC_CTYPE",
|
|
25
|
+
"TMPDIR",
|
|
26
|
+
"TMP",
|
|
27
|
+
"TEMP",
|
|
28
|
+
"SystemRoot", // Windows
|
|
29
|
+
"APPDATA", // Windows
|
|
30
|
+
"LOCALAPPDATA", // Windows
|
|
31
|
+
"ProgramFiles", // Windows
|
|
32
|
+
"ProgramFiles(x86)", // Windows
|
|
33
|
+
];
|
|
34
|
+
export function buildSpawnEnv(extra = {}) {
|
|
35
|
+
const env = {};
|
|
36
|
+
for (const key of DEFAULT_PASSTHROUGH_KEYS) {
|
|
37
|
+
const v = process.env[key];
|
|
38
|
+
if (v !== undefined)
|
|
39
|
+
env[key] = v;
|
|
40
|
+
}
|
|
41
|
+
for (const [k, v] of Object.entries(extra)) {
|
|
42
|
+
if (v !== undefined)
|
|
43
|
+
env[k] = v;
|
|
44
|
+
}
|
|
45
|
+
return env;
|
|
46
|
+
}
|
|
47
|
+
//# sourceMappingURL=spawn-env.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"spawn-env.js","sourceRoot":"","sources":["../../../src/eval-server/utils/spawn-env.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAC9E,uEAAuE;AACvE,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,wBAAwB,GAAG;IAC/B,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,SAAS;IACT,OAAO;IACP,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,KAAK;IACL,MAAM;IACN,YAAY,EAAE,UAAU;IACxB,SAAS,EAAE,UAAU;IACrB,cAAc,EAAE,UAAU;IAC1B,cAAc,EAAE,UAAU;IAC1B,mBAAmB,EAAE,UAAU;CACvB,CAAC;AAEX,MAAM,UAAU,aAAa,CAAC,QAA4C,EAAE;IAC1E,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
import{r as s,j as e}from"./globals-BRZwPAPF.js";import{u as L,S as d,F as u,C as k,D as R}from"./preferences-BKv6X7fK.js";/* empty css */import"./useDesktopBridge-DxVWbYqK.js";const g="~/.vskill/settings.json";function S(t){switch(t){case"ask":return"Show the lifecycle modal whenever another studio instance is detected.";case"use-existing":return"Always switch to the running instance — no modal, no extra sidecar.";case"stop-and-replace":return"SIGTERM the existing instance (3s grace, then SIGKILL) and start this app's sidecar.";case"run-alongside":return"Start this app's sidecar on a fresh port; both instances coexist.";default:return""}}function E({bridge:t,snapshot:i,onSnapshotChanged:r,pushToast:l}){var p;const{t:a}=L("preferences"),n=!t.available,[x,o]=s.useState(!1),[v,f]=s.useState(g);s.useEffect(()=>{if(n){f(a("advanced.settingsPath.browserValue"));return}f(g)},[n,a]);const y=(i==null?void 0:i.advanced.logLevel)??"info",h=((p=i==null?void 0:i.studio)==null?void 0:p.lifecycleDefault)??"ask",b=s.useCallback(async c=>{try{await t.setSetting("advanced.logLevel",c),await r()}catch{l({message:"Couldn't update log level.",variant:"error"})}},[t,r,l]),m=s.useCallback(async c=>{try{await t.setSetting("studio.lifecycleDefault",c),await r()}catch{l({message:"Couldn't update studio lifecycle default.",variant:"error"})}},[t,r,l]),j=s.useCallback(async()=>{try{await t.copyToClipboard(v),l({message:a("advanced.settingsPath.copied")})}catch{l({message:"Couldn't copy.",variant:"error"})}},[t,l,v,a]),w=s.useCallback(async()=>{try{await t.revealSettingsFile()}catch{l({message:"Couldn't open settings file.",variant:"error"})}},[t,l]),C=s.useCallback(async()=>{try{await t.resetSettings(),await r(),l({message:a("advanced.factoryReset.done"),variant:"success"})}catch{l({message:"Couldn't reset preferences.",variant:"error"})}finally{o(!1)}},[t,r,l,a]);return e.jsxs(e.Fragment,{children:[e.jsxs("header",{className:"preferences-content__heading",children:[e.jsx("h1",{children:a("advanced.heading")}),e.jsx("p",{children:a("advanced.subheading")})]}),e.jsx(d,{title:a("advanced.logLevel.label"),children:e.jsx(u,{label:a("advanced.logLevel.label"),help:a("advanced.logLevel.help"),control:e.jsxs("select",{className:"pref-select",value:y,onChange:c=>b(c.target.value),disabled:n,"aria-disabled":n||void 0,"aria-label":a("advanced.logLevel.label"),children:[e.jsx("option",{value:"error",children:a("advanced.logLevel.error")}),e.jsx("option",{value:"warn",children:a("advanced.logLevel.warn")}),e.jsx("option",{value:"info",children:a("advanced.logLevel.info")}),e.jsx("option",{value:"debug",children:a("advanced.logLevel.debug")}),e.jsx("option",{value:"trace",children:a("advanced.logLevel.trace")})]})})}),e.jsx(d,{title:"Studio lifecycle",children:e.jsx(u,{label:"When another Skill Studio is already running",help:"Choose what the desktop app should do at launch when an existing instance is detected. 'Ask each time' shows the modal; the others run silently.",control:e.jsxs("select",{className:"pref-select",value:h,onChange:c=>m(c.target.value),disabled:n,"aria-disabled":n||void 0,"aria-label":"Studio lifecycle default",title:S(h),children:[e.jsx("option",{value:"ask",children:"Ask each time (default)"}),e.jsx("option",{value:"use-existing",children:"Use existing instance"}),e.jsx("option",{value:"stop-and-replace",children:"Stop existing + use this app"}),e.jsx("option",{value:"run-alongside",children:"Run alongside"})]})})}),e.jsx(d,{title:a("advanced.settingsPath.label"),children:e.jsx(u,{stacked:!0,label:a("advanced.settingsPath.label"),help:a("advanced.settingsPath.help"),control:e.jsxs("div",{style:{display:"flex",gap:8,marginTop:6,flexWrap:"wrap"},children:[e.jsx("code",{className:"pref-path-display",style:{flex:1,minWidth:200},children:v}),e.jsx("button",{type:"button",className:"pref-button",onClick:j,children:a("advanced.settingsPath.copy")}),e.jsx("button",{type:"button",className:"pref-button",onClick:w,disabled:n,"aria-disabled":n||void 0,children:a("advanced.settingsPath.reveal")})]})})}),e.jsx(d,{title:a("advanced.factoryReset.label"),children:e.jsx(u,{label:a("advanced.factoryReset.label"),help:a("advanced.factoryReset.help"),control:e.jsx("button",{type:"button",className:"pref-button pref-button--danger",onClick:()=>o(!0),children:a("advanced.factoryReset.button")})})}),n?e.jsx(k,{variant:"info",children:a("app.browserCallout")}):null,e.jsxs(R,{open:x,onDismiss:()=>o(!1),ariaLabel:a("advanced.factoryReset.confirmTitle"),children:[e.jsx("h2",{className:"pref-dialog__title",children:a("advanced.factoryReset.confirmTitle")}),e.jsx("p",{className:"pref-dialog__body",children:a("advanced.factoryReset.confirmBody")}),e.jsxs("div",{className:"pref-dialog__actions",children:[e.jsx("button",{type:"button",className:"pref-button",onClick:()=>o(!1),children:a("advanced.factoryReset.cancel")}),e.jsx("button",{type:"button",className:"pref-button pref-button--danger",onClick:C,children:a("advanced.factoryReset.confirm")})]})]})]})}export{E as AdvancedTab};
|