wizards 0.1.11 → 0.2.1

package/apps/runtime/dist/plugins/migrations.js

@@ -0,0 +1,69 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { openTenantClients } from "../db/client.js";
+import { loadedPlugins } from "./registry.js";
+/**
+ * A plugin's own tables. Each `.sql` file of the folders a plugin registered runs once per
+ * tenant database, in the order of the file names; `plugin_migration` records which ran. A
+ * database gets them when it opens, and the open ones get them when a plugin loads. Unloading a
+ * plugin leaves its tables and their rows where they are.
+ */
+const RECORD = `CREATE TABLE IF NOT EXISTS plugin_migration (
+  plugin TEXT NOT NULL,
+  name TEXT NOT NULL,
+  applied_at INTEGER NOT NULL,
+  PRIMARY KEY (plugin, name)
+)`;
+/** One at a time per database: a plugin that loads while a database opens must not run a file twice. */
+const queues = new Map();
+async function apply(client) {
+    const pending = loadedPlugins().filter((p) => p.migrations.length);
+    if (!pending.length) {
+        return;
+    }
+    await client.execute(RECORD);
+    const done = await client.execute("SELECT plugin, name FROM plugin_migration");
+    const ran = new Set(done.rows.map((row) => `${row.plugin}/${row.name}`));
+    for (const plugin of pending) {
+        for (const folder of plugin.migrations) {
+            const files = readdirSync(folder)
+                .filter((name) => name.endsWith(".sql"))
+                .sort();
+            for (const name of files) {
+                if (ran.has(`${plugin.source.id}/${name}`)) {
+                    continue;
+                }
+                // The file and its record go in together or not at all.
+                const tx = await client.transaction("write");
+                try {
+                    await tx.executeMultiple(readFileSync(join(folder, name), "utf8"));
+                    await tx.execute({
+                        sql: "INSERT INTO plugin_migration (plugin, name, applied_at) VALUES (?, ?, ?)",
+                        args: [plugin.source.id, name, Date.now()],
+                    });
+                    await tx.commit();
+                }
+                catch (err) {
+                    await tx.rollback().catch(() => undefined);
+                    throw new Error(`Plugin "${plugin.source.id}", ${name}: ${err.message}`);
+                }
+                finally {
+                    tx.close();
+                }
+            }
+        }
+    }
+}
+export function migratePlugins(tenantId, client) {
+    const next = (queues.get(tenantId) ?? Promise.resolve())
+        .catch(() => undefined)
+        .then(() => apply(client));
+    queues.set(tenantId, next);
+    return next;
+}
+/** After a plugin loaded: its tables for every database that is open already. */
+export async function migrateOpenTenants() {
+    for (const [tenantId, client] of await openTenantClients()) {
+        await migratePlugins(tenantId, client).catch((err) => console.error(`[plugins] tables for tenant ${tenantId}:`, err.message));
+    }
+}

package/apps/runtime/dist/plugins/registry.js

@@ -0,0 +1,105 @@
+import { createHash } from "node:crypto";
+import { EventEmitter } from "node:events";
+import { readFileSync } from "node:fs";
+import { env } from "../env.js";
+import { managed, tenantInfo } from "../manage.js";
+const plugins = new Map();
+let generations = 0;
+export function nextGeneration() {
+    return ++generations;
+}
+export function emptyRecord(source) {
+    return {
+        source,
+        generation: nextGeneration(),
+        error: null,
+        routes: [],
+        tools: new Map(),
+        listeners: {},
+        migrations: [],
+        disposers: [],
+    };
+}
+export function setPlugin(record) {
+    plugins.set(record.source.id, record);
+}
+export function dropPlugin(id) {
+    const record = plugins.get(id);
+    plugins.delete(id);
+    return record;
+}
+export function loadedPlugin(id) {
+    return plugins.get(id);
+}
+export function loadedPlugins() {
+    return [...plugins.values()];
+}
+/** `/items/:id` as a pattern for the address below the plugin's own. */
+export function compileRoute(route) {
+    const params = [];
+    const path = route.path.startsWith("/") ? route.path : `/${route.path}`;
+    const source = path
+        .replace(/\/+$/, "")
+        .split("/")
+        .map((part) => {
+        if (part.startsWith(":")) {
+            params.push(part.slice(1));
+            return "([^/]+)";
+        }
+        return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    })
+        .join("/");
+    return { route, pattern: new RegExp(`^${source}/?$`), params };
+}
+// --- which tenant has which plugin -----------------------------------------------------
+/**
+ * The ids of the plugins a tenant has. A runtime that runs alone has every plugin it loaded.
+ * Managed, a tenant has the ones in `PLUGINS_DEFAULT` and the ones the Manage-App lists for it
+ * (`modules` of `GET /v1/tenants/:id`).
+ */
+export async function pluginIdsOf(tenantId) {
+    if (!managed) {
+        return new Set(plugins.keys());
+    }
+    const listed = await tenantInfo(tenantId)
+        .then((info) => info.modules ?? [])
+        .catch(() => []);
+    return new Set([...env.plugins.defaults, ...listed].filter((id) => plugins.has(id)));
+}
+export async function pluginsOf(tenantId) {
+    const ids = await pluginIdsOf(tenantId);
+    return loadedPlugins().filter((p) => ids.has(p.source.id));
+}
+/** The tools the tenant's plugins add, by the id a step lists them under. */
+export async function pluginToolsOf(tenantId) {
+    return (await pluginsOf(tenantId)).flatMap((plugin) => [...plugin.tools.values()].map((tool) => ({
+        id: `${plugin.source.id}.${tool.name}`,
+        title: tool.title ?? tool.name,
+        description: tool.description,
+    })));
+}
+/** The built studio half as it is on disk now; null when the plugin has none. */
+export function pluginAsset(record, kind) {
+    const file = record.source[kind];
+    if (!file) {
+        return null;
+    }
+    try {
+        return {
+            file,
+            rev: createHash("sha256").update(readFileSync(file)).digest("hex").slice(0, 12),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+const changes = new EventEmitter();
+changes.setMaxListeners(0);
+export function announceChange(change) {
+    changes.emit("change", change);
+}
+export function onPluginChange(listener) {
+    changes.on("change", listener);
+    return () => changes.off("change", listener);
+}

package/apps/runtime/dist/routes/plugins.js

@@ -0,0 +1,160 @@
+import { readFile } from "node:fs/promises";
+import { Hono } from "hono";
+import { streamSSE } from "hono/streaming";
+import { managed } from "../manage.js";
+import { pluginProblems, reloadPlugin, rescanPlugins } from "../plugins/loader.js";
+import { loadedPlugin, onPluginChange, pluginAsset, pluginIdsOf, pluginsOf, } from "../plugins/registry.js";
+const admin = (user) => user.role === "owner" || user.role === "admin";
+/** Plugins change while the app runs only where it runs alone: a reload would hit every tenant. */
+const canReload = (user) => !managed && admin(user);
+function view(plugin) {
+    const script = pluginAsset(plugin, "studio");
+    const styles = pluginAsset(plugin, "styles");
+    const { id, name, version, description } = plugin.source.manifest;
+    const address = (file, rev) => `/api/studio/plugins/-/assets/${id}/${file}?rev=${rev}`;
+    return {
+        id,
+        name,
+        version,
+        description: description ?? "",
+        generation: plugin.generation,
+        /** Why the server half did not load; the plugin then adds nothing on the server. */
+        error: plugin.error,
+        script: script ? address("client.js", script.rev) : null,
+        styles: styles ? address("client.css", styles.rev) : null,
+        tools: [...plugin.tools.values()].map((tool) => ({
+            id: `${id}.${tool.name}`,
+            title: tool.title ?? tool.name,
+        })),
+    };
+}
+/** A thrown error that says how to answer: `{ status, code }`, as the runtime's own errors do. */
+function answerOf(err) {
+    const e = err;
+    return typeof e?.status === "number" &&
+        e.status >= 400 &&
+        e.status < 600 &&
+        typeof e.code === "string"
+        ? { status: e.status, body: { error: String(e.message ?? e.code), code: e.code } }
+        : null;
+}
+async function dispatch(c) {
+    const user = c.get("user");
+    const id = c.req.param("id") ?? "";
+    const plugin = (await pluginIdsOf(user.tenantId)).has(id) ? loadedPlugin(id) : undefined;
+    if (!plugin) {
+        return c.json({ error: "not found", code: "not_found" }, 404);
+    }
+    const url = new URL(c.req.url);
+    const path = url.pathname.slice(url.pathname.indexOf(`/plugins/${id}`) + `/plugins/${id}`.length);
+    for (const { route, pattern, params } of plugin.routes) {
+        const match = route.method === c.req.method ? pattern.exec(path) : null;
+        if (!match) {
+            continue;
+        }
+        if (route.role === "admin" && !admin(user)) {
+            return c.json({ error: "forbidden", code: "forbidden" }, 403);
+        }
+        const request = {
+            request: c.req.raw,
+            path: path || "/",
+            params: Object.fromEntries(params.map((name, i) => [name, decodeURIComponent(match[i + 1])])),
+            query: url.searchParams,
+            user: {
+                id: user.id,
+                tenantId: user.tenantId,
+                role: user.role,
+                name: user.name,
+                email: user.email,
+            },
+            json: async () => {
+                const text = await c.req.text();
+                return (text ? JSON.parse(text) : {});
+            },
+        };
+        try {
+            const result = await route.handler(request);
+            return result instanceof Response ? result : c.json(result ?? null);
+        }
+        catch (err) {
+            const answer = answerOf(err);
+            if (answer) {
+                return c.json(answer.body, answer.status);
+            }
+            console.error(`[plugin ${id}] ${route.method} ${path}:`, err);
+            return c.json({ error: "The plugin failed.", code: "plugin_failed" }, 500);
+        }
+    }
+    return c.json({ error: "not found", code: "not_found" }, 404);
+}
+const TYPES = {
+    "client.js": { kind: "studio", type: "text/javascript; charset=utf-8" },
+    "client.css": { kind: "styles", type: "text/css; charset=utf-8" },
+};
+export const pluginRoutes = new Hono()
+    .get("/", async (c) => {
+    const user = c.get("user");
+    return c.json({
+        plugins: (await pluginsOf(user.tenantId)).map(view),
+        canReload: canReload(user),
+        /** What looked like a plugin and is none; for the person who installs them. */
+        problems: canReload(user) ? pluginProblems() : [],
+    });
+})
+    // The built studio half. The address carries the file's revision, so it may be kept for good.
+    .get("/-/assets/:id/:file", async (c) => {
+    const user = c.get("user");
+    const file = c.req.param("file");
+    const kind = Object.hasOwn(TYPES, file) ? TYPES[file] : undefined;
+    const id = c.req.param("id");
+    const plugin = (await pluginIdsOf(user.tenantId)).has(id) ? loadedPlugin(id) : undefined;
+    const asset = plugin && kind ? pluginAsset(plugin, kind.kind) : null;
+    if (!asset || !kind) {
+        return c.json({ error: "not found", code: "not_found" }, 404);
+    }
+    return c.body(new Uint8Array(await readFile(asset.file)), 200, {
+        "content-type": kind.type,
+        "cache-control": c.req.query("rev") === asset.rev ? "private, max-age=31536000, immutable" : "no-cache",
+    });
+})
+    // Says when a plugin loaded again, so an open studio takes the new one without a page load.
+    .get("/-/events", (c) => {
+    if (managed) {
+        return c.json({ error: "not found", code: "not_found" }, 404);
+    }
+    return streamSSE(c, async (stream) => {
+        let closed = false;
+        const stop = onPluginChange((change) => {
+            void stream.writeSSE({ event: "change", data: JSON.stringify(change) });
+        });
+        stream.onAbort(() => {
+            closed = true;
+            stop();
+        });
+        await stream.writeSSE({ event: "ready", data: "{}" });
+        while (!closed) {
+            await stream.sleep(20_000);
+            if (!closed) {
+                await stream.writeSSE({ event: "ping", data: "{}" });
+            }
+        }
+    });
+})
+    .post("/-/reload", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+    }
+    await rescanPlugins();
+    return c.json({ plugins: (await pluginsOf(c.get("user").tenantId)).map(view) });
+})
+    .post("/-/reload/:id", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+    }
+    const plugin = await reloadPlugin(c.req.param("id"));
+    return plugin
+        ? c.json({ plugin: view(plugin) })
+        : c.json({ error: "not found", code: "not_found" }, 404);
+})
+    .all("/:id", dispatch)
+    .all("/:id/*", dispatch);

package/apps/runtime/dist/routes/runs.js

@@ -21,7 +21,7 @@ import { hashIp, verifyTurnstile, wizardUnavailable } from "../limits.js";
 import { ModelUnavailableError } from "../model-errors.js";
 import { listDownload, renderDownload, stepHtml } from "../render/downloads.js";
 import { HTML_RESPONSE_CSP } from "../render/guard.js";
-import { verifySignedUrl } from "../secrets/signing.js";
+import { runTicketValid, verifySignedUrl } from "../secrets/signing.js";
 import { brandView } from "../services/brand.js";
 import { ServiceError } from "../services/errors.js";
 import { sharedRun, shareImage, shareRun, shareView, unshareRun } from "../services/shares.js";
@@ -62,8 +62,9 @@ function visitorId(c, create, embedded = false) {
     return vid;
 }
 /**
- * The run, if the caller may see it: its visitor, the admin who owns the wizard, or — on the
- * read-only file routes — a signed link handed out to the owner's MCP client.
+ * The run, if the caller may see it: its visitor, the admin who owns the wizard, the widget of
+ * the owner's AI app with its run ticket, or — on the read-only file routes — a signed link
+ * handed out to the owner's MCP client.
  */
 async function accessibleRun(c, runId, opts = {}) {
     const run = await db.query.run.findFirst({ where: eq(schema.run.id, runId) });
@@ -73,6 +74,9 @@ async function accessibleRun(c, runId, opts = {}) {
     if (opts.signed && verifySignedUrl(c.req.url)) {
         return run;
     }
+    if (runTicketValid(run.id, c.req.query("rt"))) {
+        return run;
+    }
     const vid = visitorId(c, false);
     if (vid && run.visitorId === vid) {
         return run;

package/apps/runtime/dist/routes/studio.js

@@ -10,6 +10,8 @@ import { runProjectAssistant } from "../agents/project-assistant.js";
 import { chatEngine, setChatEngine, subscriptionClients } from "../agents/subscription.js";
 import { accountOverview, linkedAccount, startLink, unlink } from "../auth/account.js";
 import { createLocalKey, deleteLocalKey, listLocalKeys } from "../auth/keys.js";
+import { appStates, connectApps } from "../cli/connect.js";
+import { layout } from "../cli/home.js";
 import { connectorImportSchema, importConnector, listConnectors, previewSource, refreshConnector, registryService, removeConnector, searchRegistry, } from "../connectors/external.js";
 import { balanceCredits, canSpend } from "../credits/credits.js";
 import { estimateRun } from "../credits/estimate.js";
@@ -19,6 +21,7 @@ import { freshAuth, loginEnv } from "../harness/env.js";
 import { detectHarness, detectHarnesses, HARNESS_IDS, harness, installSpec, } from "../harness/index.js";
 import { closeTerminal, openTerminal, resizeTerminal, subscribeTerminal, writeTerminal, } from "../harness/terminal.js";
 import { managed } from "../manage.js";
+import { seenApps } from "../mcp/seen.js";
 import { transcribeAudio } from "../media/transcribe.js";
 import { embeddingModel, hasTextModel, LOCAL_KEYS, localModelSettings, ModelUnavailableError, saveLocalModels, textModel, } from "../models.js";
 import { HTML_RESPONSE_CSP } from "../render/guard.js";
@@ -530,6 +533,23 @@ export const studio = new Hono()
     await deleteLocalKey(c.req.param("id"));
     return c.json({ ok: true });
 })
+    // The person's AI apps on this machine (Claude Desktop, Cursor, Codex …) and whether they
+    // have this install's MCP server: the same as `wizards connect`.
+    .get("/local/apps", async (c) => (managed ? c.notFound() : c.json(await appStates(layout()))))
+    .post("/local/apps/:id", async (c) => {
+    if (managed) {
+        return c.notFound();
+    }
+    const { connect } = z.object({ connect: z.boolean() }).parse(await c.req.json());
+    const [done] = await connectApps(layout(), [c.req.param("id")], !connect);
+    if (!done) {
+        return c.json({ error: "Unknown app" }, 404);
+    }
+    // Not done is an answer too: the app's file is no plain JSON, here is what to paste.
+    return c.json(done.outcome);
+})
+    // What each AI client did with the MCP server since the start: the test on "Integrate".
+    .get("/integrations/seen", (c) => c.json(seenApps(c.get("user").tenantId)))
     .get("/local/models", (c) => (managed ? c.notFound() : c.json(localModelSettings())))
     .put("/local/models", async (c) => {
     if (managed) {

package/apps/runtime/dist/secrets/signing.js

@@ -21,6 +21,11 @@ export function signedUrl(path, ttlSeconds = 3600) {
     url.searchParams.set("sig", sign(payload(url, exp)));
     return url.toString();
 }
+function sameSignature(data, sig) {
+    const expected = Buffer.from(sign(data));
+    const given = Buffer.from(sig);
+    return expected.length === given.length && timingSafeEqual(expected, given);
+}
 export function verifySignedUrl(href) {
     const url = new URL(href, env.appUrl);
     const exp = url.searchParams.get("exp");
@@ -28,7 +33,20 @@ export function verifySignedUrl(href) {
     if (!exp || !sig || Number(exp) * 1000 < Date.now()) {
         return false;
     }
-    const expected = Buffer.from(sign(payload(url, exp)));
-    const given = Buffer.from(sig);
-    return expected.length === given.length && timingSafeEqual(expected, given);
+    return sameSignature(payload(url, exp), sig);
+}
+/**
+ * A ticket to one run's routes without a session: the widget an AI app shows runs on the host's
+ * origin and reaches the run with it. Sent as `?rt=`, since an EventSource sends no headers.
+ */
+export function runTicket(runId, ttlSeconds = 12 * 3600) {
+    const exp = String(Math.floor(Date.now() / 1000) + ttlSeconds);
+    return `${exp}.${sign(`run:${runId}|${exp}`)}`;
+}
+export function runTicketValid(runId, ticket) {
+    const [exp, sig] = (ticket ?? "").split(".");
+    if (!exp || !sig || Number(exp) * 1000 < Date.now()) {
+        return false;
+    }
+    return sameSignature(`run:${runId}|${exp}`, sig);
 }