wizards 0.1.9

package/apps/runtime/dist/agents/website.js

@@ -0,0 +1,197 @@
+import { webContext } from "../render/chromium.js";
+import { htmlToMarkdown } from "../render/convert.js";
+import { safeFetch } from "../tools/net-guard.js";
+const UA = { "user-agent": "Mozilla/5.0 (compatible; engenty-wizards/0.1)" };
+const attr = (tag, name) => tag
+    .match(new RegExp(`\\b${name}\\s*=\\s*("([^"]*)"|'([^']*)'|([^\\s>]+))`, "i"))
+    ?.slice(2)
+    .find(Boolean) ?? "";
+function absolute(href, base) {
+    try {
+        const url = new URL(href.trim(), base);
+        return url.protocol === "http:" || url.protocol === "https:" ? url.toString() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hex(value) {
+    const v = value.trim().toLowerCase();
+    const short = v.match(/^#([0-9a-f])([0-9a-f])([0-9a-f])$/);
+    if (short) {
+        return `#${short[1]}${short[1]}${short[2]}${short[2]}${short[3]}${short[3]}`;
+    }
+    if (/^#[0-9a-f]{6}$/.test(v)) {
+        return v;
+    }
+    if (/^#[0-9a-f]{8}$/.test(v)) {
+        return v.slice(0, 7);
+    }
+    const rgb = v.match(/^rgba?\(\s*(\d{1,3})[\s,]+(\d{1,3})[\s,]+(\d{1,3})/);
+    if (rgb) {
+        return `#${rgb
+            .slice(1, 4)
+            .map((n) => Math.min(255, Number(n)).toString(16).padStart(2, "0"))
+            .join("")}`;
+    }
+    return null;
+}
+/** How far a colour is from grey, 0–255. */
+function chroma(color) {
+    const [r, g, b] = [1, 3, 5].map((i) => Number.parseInt(color.slice(i, i + 2), 16));
+    return Math.max(r, g, b) - Math.min(r, g, b);
+}
+function coloursOf(css) {
+    const variables = [];
+    for (const m of css.matchAll(/(--[\w-]+)\s*:\s*(#[0-9a-fA-F]{3,8}|rgba?\([^)]*\))/g)) {
+        const value = hex(m[2]);
+        if (value && !variables.some((v) => v.name === m[1])) {
+            variables.push({ name: m[1], value });
+        }
+    }
+    const counts = new Map();
+    for (const m of css.matchAll(/#[0-9a-fA-F]{3,8}\b|rgba?\([^)]*\)/g)) {
+        const value = hex(m[0]);
+        if (value) {
+            counts.set(value, (counts.get(value) ?? 0) + 1);
+        }
+    }
+    const telling = /brand|primary|accent|main|theme|secondary|highlight|cta|link/i;
+    return {
+        variables: variables
+            .sort((a, b) => Number(telling.test(b.name)) - Number(telling.test(a.name)))
+            .slice(0, 24),
+        frequent: [...counts.entries()]
+            .sort((a, b) => Number(chroma(b[0]) > 24) - Number(chroma(a[0]) > 24) || b[1] - a[1])
+            .slice(0, 12)
+            .map(([value]) => value),
+    };
+}
+async function stylesheet(url, signal) {
+    try {
+        const res = await safeFetch(url, {
+            headers: UA,
+            signal: AbortSignal.any([AbortSignal.timeout(10_000), ...(signal ? [signal] : [])]),
+        });
+        return res.ok ? (await res.text()).slice(0, 400_000) : "";
+    }
+    catch {
+        return "";
+    }
+}
+/** The page as a browser shows it, for sites that write their text with scripts. */
+async function rendered(url) {
+    try {
+        const context = await webContext();
+        try {
+            const page = await context.newPage();
+            await page.goto(url, { waitUntil: "networkidle", timeout: 25_000 }).catch(() => undefined);
+            return await page.content();
+        }
+        finally {
+            await context.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export async function readWebsite(raw, signal) {
+    const res = await safeFetch(/^https?:\/\//i.test(raw) ? raw : `https://${raw}`, {
+        headers: UA,
+        signal: AbortSignal.any([AbortSignal.timeout(20_000), ...(signal ? [signal] : [])]),
+    });
+    const base = res.url;
+    let html = (await res.text()).slice(0, 1_500_000);
+    // Hardly any text in the page as sent: it is written in the browser.
+    if (res.ok && htmlToMarkdown(html).replace(/\s+/g, " ").length < 500) {
+        html = ((await rendered(base)) ?? html).slice(0, 1_500_000);
+    }
+    const tags = (name) => [...html.matchAll(new RegExp(`<${name}\\b[^>]*>`, "gi"))].map((m) => m[0]);
+    const meta = (key) => {
+        const tag = tags("meta").find((t) => [attr(t, "name"), attr(t, "property")].some((v) => v.toLowerCase() === key));
+        return tag ? attr(tag, "content") : "";
+    };
+    const logos = [];
+    const addLogo = (href, hint) => {
+        const url = absolute(href, base);
+        if (url && !logos.some((l) => l.url === url)) {
+            logos.push({ url, hint });
+        }
+    };
+    const images = [];
+    for (const tag of tags("img")) {
+        const src = attr(tag, "src") || attr(tag, "data-src");
+        const alt = attr(tag, "alt");
+        if (!src || src.startsWith("data:")) {
+            continue;
+        }
+        if (/logo/i.test(`${src} ${alt} ${attr(tag, "class")} ${attr(tag, "id")}`)) {
+            addLogo(src, `image on the page${alt ? `, alt "${alt}"` : ""}`);
+        }
+        else {
+            const url = absolute(src, base);
+            if (url && images.length < 12 && !images.some((i) => i.url === url)) {
+                images.push({ url, alt });
+            }
+        }
+    }
+    for (const tag of tags("link")) {
+        const rel = attr(tag, "rel").toLowerCase();
+        if (/apple-touch-icon|mask-icon|(^|\s)icon/.test(rel)) {
+            addLogo(attr(tag, "href"), `${rel} ${attr(tag, "sizes")}`.trim());
+        }
+    }
+    const og = meta("og:image");
+    if (og) {
+        const url = absolute(og, base);
+        if (url) {
+            images.unshift({ url, alt: "share image (og:image)" });
+        }
+    }
+    const sheets = tags("link")
+        .filter((t) => /stylesheet/i.test(attr(t, "rel")))
+        .map((t) => absolute(attr(t, "href"), base))
+        .filter((u) => Boolean(u))
+        .slice(0, 4);
+    const inline = [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style>/gi)].map((m) => m[1]);
+    const styled = [...html.matchAll(/\bstyle\s*=\s*"([^"]*)"/gi)].map((m) => m[1]);
+    const css = [
+        ...inline,
+        ...styled,
+        ...(await Promise.all(sheets.map((s) => stylesheet(s, signal)))),
+    ].join("\n");
+    const host = new URL(base).hostname;
+    const links = [];
+    for (const m of html.matchAll(/<a\b([^>]*)>([\s\S]*?)<\/a>/gi)) {
+        const url = absolute(attr(`<a ${m[1]}>`, "href"), base);
+        const text = m[2]
+            .replace(/<[^>]+>/g, " ")
+            .replace(/\s+/g, " ")
+            .trim()
+            .slice(0, 60);
+        if (url &&
+            new URL(url).hostname === host &&
+            /impressum|imprint|kontakt|contact|about|ueber|über|team|legal|unternehmen|company/i.test(`${url} ${text}`) &&
+            !links.some((l) => l.url === url)) {
+            links.push({ url, text });
+        }
+    }
+    const text = htmlToMarkdown(html);
+    return {
+        url: base,
+        status: res.status,
+        title: html.match(/<title[^>]*>([\s\S]*?)<\/title>/i)?.[1].trim() ?? "",
+        description: meta("description") || meta("og:description"),
+        text: text.length > 9000
+            ? `${text.slice(0, 9000)}\n…[${text.length - 9000} more characters]`
+            : text,
+        brand: {
+            themeColor: hex(meta("theme-color")),
+            ...coloursOf(css),
+            logos: logos.slice(0, 10),
+            images,
+        },
+        links: links.slice(0, 10),
+    };
+}

package/apps/runtime/dist/app.js

@@ -0,0 +1,153 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { ZodError } from "zod";
+import { authRoutes, principalOf } from "./auth/index.js";
+import { withTenant } from "./db/client.js";
+import { basePath, env } from "./env.js";
+import { linkPreview } from "./link-preview.js";
+import { discovery, managed } from "./manage.js";
+import { bridgeRequest } from "./mcp/bridge.js";
+import { mcpHandler } from "./mcp/handler.js";
+import { MCP_RESOURCE, SCOPES } from "./mcp/scopes.js";
+import { PLUGIN_NAME, pluginArchive, pluginMarketplace } from "./plugin.js";
+import { apiRoutes } from "./routes/api.js";
+import { internalRoutes } from "./routes/internal.js";
+import { marketplaceStudio } from "./routes/marketplace.js";
+import { connectCallback, publicRoutes, runRoutes, shareRoutes } from "./routes/runs.js";
+import { studio } from "./routes/studio.js";
+import { wizardStream } from "./routes/wizard-stream.js";
+import { ServiceError } from "./services/errors.js";
+import { tenantOfLink, tenantStatus } from "./tenants/control.js";
+const app = new Hono();
+app.onError((err, c) => {
+    if (err instanceof ServiceError) {
+        return c.json(err.toJSON(), err.status);
+    }
+    if (err instanceof ZodError) {
+        return c.json({ error: "Ungültige Eingabe", issues: err.issues }, 400);
+    }
+    if (err instanceof HTTPException) {
+        return err.getResponse();
+    }
+    console.error(err);
+    return c.json({ error: "Interner Fehler" }, 500);
+});
+// --- who may talk to this server at all ---------------------------------------------
+// A runtime that runs alone listens on the loopback interface. A web page in the person's
+// browser could still reach it there, so the Host header must be one of ours (DNS rebinding)
+// and a request that changes something must come from our own origin.
+const ownHosts = new Set([new URL(env.appUrl).host, ...env.allowedHosts]);
+const loopback = /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/;
+const hostAllowed = (host) => ownHosts.has(host) || loopback.test(host);
+app.use("*", async (c, next) => {
+    if (managed) {
+        return next();
+    }
+    if (!hostAllowed(c.req.header("host") ?? new URL(c.req.url).host)) {
+        return c.text("Forbidden host", 403);
+    }
+    const origin = c.req.header("origin");
+    const safe = c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "OPTIONS";
+    // MCP clients and scripts send no Origin; a browser always does on a cross-origin write.
+    if (!safe && origin && !hostAllowed(new URL(origin).host)) {
+        return c.text("Forbidden origin", 403);
+    }
+    return next();
+});
+app.get("/api/health", (c) => c.json({ ok: true }));
+app.route("/api", authRoutes);
+app.get("/api/config", (c) => c.json({
+    mode: managed ? "managed" : "local",
+    devLogin: !managed && env.devLogin,
+    /** The product's own site, for a runtime that runs alone. */
+    site: managed ? null : env.local.cloudUrl,
+    signedOutUrl: managed && env.signedOutUrl ? env.signedOutUrl : null,
+}));
+// OAuth discovery for MCP clients (RFC 9728): the Manage-App is the authorization server.
+app.get("/.well-known/oauth-protected-resource/*", async (c) => {
+    if (!managed) {
+        return c.notFound();
+    }
+    const d = await discovery();
+    return c.json({
+        resource: MCP_RESOURCE,
+        authorization_servers: [d.issuer],
+        scopes_supported: SCOPES,
+        bearer_methods_supported: ["header"],
+    });
+});
+/** Studio requests act as the signed-in person, inside that person's tenant. */
+app.use("/api/studio/*", async (c, next) => {
+    const user = await principalOf(c);
+    if (!user) {
+        return c.json({ error: "unauthorized" }, 401);
+    }
+    if ((await tenantStatus(user.tenantId)) === "suspended") {
+        return c.json({ error: "Dieses Konto ist gesperrt.", code: "suspended" }, 403);
+    }
+    c.set("user", user);
+    return withTenant(user.tenantId, next);
+});
+const mcp = mcpHandler();
+app.on(["GET", "POST", "DELETE"], "/api/mcp", (c) => mcp(c.req.raw));
+// The tools of one model call, for the installed Claude Code while it answers that call.
+app.on(["GET", "POST", "DELETE"], "/api/mcp/bridge/:token", (c) => bridgeRequest(c.req.param("token"), c.req.raw));
+app.route("/api/studio/wizards", wizardStream);
+app.route("/api/studio/marketplace", marketplaceStudio);
+app.route("/api/studio", studio);
+app.route("/api/v1", apiRoutes);
+app.route("/api/internal", internalRoutes);
+app.route("/api/public", publicRoutes);
+app.route("/api/runs", runRoutes);
+app.route("/api/shares", shareRoutes);
+app.route("/api/connect", connectCallback);
+// The Claude Code plugin of this deployment: `claude plugin marketplace add <APP_URL>/api/claude-plugin/marketplace.json`.
+app.get("/api/claude-plugin/marketplace.json", async (c) => c.json(await pluginMarketplace()));
+app.get(`/api/claude-plugin/${PLUGIN_NAME}.zip`, async (c) => {
+    const { zip } = await pluginArchive();
+    return c.body(new Uint8Array(zip), 200, { "content-type": "application/zip" });
+});
+app.all("/api/*", (c) => c.json({ error: "not found" }, 404));
+/** Link cards for `/w/<token>` and `/s/<token>`; the token names the tenant. */
+async function previewFor(path) {
+    const m = path.match(/^\/(w|s)\/([A-Za-z0-9_-]+)\/?$/);
+    const tenant = m ? await tenantOfLink(m[2], m[1] === "w" ? "wizard" : "result") : null;
+    return tenant ? withTenant(tenant, () => linkPreview(path)) : null;
+}
+/**
+ * Production: the built app. Its files and the studio's pages sit below `/studio`; the public
+ * pages are `/w/<token>` and `/s/<token>`. Of the root only what others fetch there is served:
+ * the installer, the embed script for websites, and the service worker of public wizards. The
+ * rest of the root belongs to others (the landing page); a runtime alone sends `/` to the studio.
+ */
+const webDir = resolve(dirname(fileURLToPath(import.meta.url)), "../../web/dist");
+const ROOT_FILES = ["/install.sh", "/embed.js", "/sw.js"];
+const PAGES = /^\/(studio(\/|$)|w\/|s\/)/;
+if (existsSync(webDir)) {
+    for (const file of ROOT_FILES) {
+        app.get(file, serveStatic({ root: webDir }));
+    }
+    app.use("/studio/*", serveStatic({ root: webDir, rewriteRequestPath: (path) => path.slice("/studio".length) }));
+    app.get("/", (c) => c.redirect(`${basePath}/studio/`));
+    app.get("*", async (c) => {
+        if (!PAGES.test(c.req.path)) {
+            return c.text("Not found", 404);
+        }
+        const html = await readFile(join(webDir, "index.html"), "utf8");
+        const preview = await previewFor(c.req.path).catch(() => null);
+        // A wizard's link installs as that wizard: its own name and start address on the home screen.
+        const token = c.req.path.match(/^\/w\/([A-Za-z0-9_-]{6,64})(?:\/|$)/)?.[1];
+        const page = token
+            ? html.replace(/href="[^"]*manifest\.webmanifest"/, `href="${basePath}/api/public/wizards/${token}/manifest.webmanifest"`)
+            : html;
+        return c.html(preview
+            ? page.replace(/<title>[^<]*<\/title>/, "").replace("</head>", `${preview}\n</head>`)
+            : page);
+    });
+}
+export default app;

package/apps/runtime/dist/auth/account.js

@@ -0,0 +1,121 @@
+import { createHash, randomBytes } from "node:crypto";
+import { env } from "../env.js";
+import { discovery, tokenRequest, unverifiedClaims } from "../manage.js";
+import { seal, unseal } from "../secrets/crypto.js";
+import { vaultDelete, vaultGet, vaultSet } from "../secrets/vault.js";
+import { deleteSetting, readSetting, writeSetting } from "../settings.js";
+/**
+ * The account a runtime that runs alone is linked to: sign-in (or sign-up) happens in the system
+ * browser at the Manage-App, the code comes back to this server on the loopback interface. The
+ * account is optional; it unlocks credits through the gateway and publishing to the cloud.
+ */
+const CLIENT = { id: "wizards-desktop" };
+const REFRESH = "account.refresh";
+const SCOPE = "openid profile email offline_access wizards:read wizards:write wizards:publish";
+/** Loopback redirect on the port this server listens on (RFC 8252). */
+function redirectUri() {
+    return `http://127.0.0.1:${env.port}/api/auth/callback`;
+}
+export async function startLink() {
+    const d = await discovery(env.local.accountUrl);
+    const verifier = randomBytes(32).toString("base64url");
+    const state = { verifier, redirect: redirectUri(), exp: Date.now() + 15 * 60_000 };
+    const url = new URL(d.authorization_endpoint);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        client_id: CLIENT.id,
+        redirect_uri: state.redirect,
+        scope: SCOPE,
+        resource: env.local.cloudUrl,
+        code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+        code_challenge_method: "S256",
+        state: seal(state),
+    }).toString();
+    return url.toString();
+}
+let cached = null;
+async function keep(tokens) {
+    const claims = unverifiedClaims(tokens.access_token);
+    if (!claims) {
+        throw new Error("The account's token names no tenant.");
+    }
+    if (tokens.refresh_token) {
+        await vaultSet(REFRESH, tokens.refresh_token);
+    }
+    cached = {
+        token: tokens.access_token,
+        expiresAt: Date.now() + (tokens.expires_in ?? 600) * 1000,
+    };
+    const account = {
+        userId: claims.userId,
+        tenantId: claims.tenantId,
+        name: claims.name,
+        email: claims.email,
+    };
+    await writeSetting("account", account);
+    return account;
+}
+export async function finishLink(code, rawState) {
+    const state = unseal(rawState);
+    if (!state || state.exp < Date.now()) {
+        throw new Error("This sign-in has expired.");
+    }
+    const tokens = await tokenRequest({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: state.redirect,
+        code_verifier: state.verifier,
+        resource: env.local.cloudUrl,
+    }, CLIENT, env.local.accountUrl);
+    return keep(tokens);
+}
+export function linkedAccount() {
+    return readSetting("account");
+}
+/** A fresh access token of the linked account, or null when none is linked (or it was revoked). */
+export async function accountToken() {
+    if (cached && cached.expiresAt - Date.now() > 60_000) {
+        return cached.token;
+    }
+    const refresh = await vaultGet(REFRESH);
+    if (!refresh) {
+        return null;
+    }
+    try {
+        const tokens = await tokenRequest({ grant_type: "refresh_token", refresh_token: refresh, resource: env.local.cloudUrl }, CLIENT, env.local.accountUrl);
+        await keep(tokens);
+        return tokens.access_token;
+    }
+    catch {
+        return null;
+    }
+}
+export async function unlink() {
+    const refresh = await vaultGet(REFRESH);
+    if (refresh) {
+        const d = await discovery(env.local.accountUrl).catch(() => null);
+        if (d?.revocation_endpoint) {
+            await fetch(d.revocation_endpoint, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({ token: refresh, client_id: CLIENT.id }),
+                signal: AbortSignal.timeout(10_000),
+            }).catch(() => undefined);
+        }
+    }
+    cached = null;
+    await vaultDelete(REFRESH);
+    await deleteSetting("account");
+}
+/** Balance and tenants of the linked account, straight from the Manage-App. */
+export async function accountOverview() {
+    const token = await accountToken();
+    if (!token) {
+        return null;
+    }
+    const res = await fetch(`${env.local.accountUrl}/v1/me`, {
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(10_000),
+    }).catch(() => null);
+    return res?.ok ? (await res.json()) : null;
+}