workplane 0.4.3 → 0.5.0

package/dist/server.js

@@ -9,7 +9,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// ../workplans/src/providers/anthropic.ts
+// ../../libs/workplans/src/providers/anthropic.ts
 var anthropic_exports = {};
 __export(anthropic_exports, {
   runAnthropicStep: () => runAnthropicStep
@@ -26,12 +26,12 @@ async function runAnthropicStep(opts) {
   return block.type === "text" ? block.text : "";
 }
 var init_anthropic = __esm({
-  "../workplans/src/providers/anthropic.ts"() {
+  "../../libs/workplans/src/providers/anthropic.ts"() {
     "use strict";
   }
 });
 
-// ../workplans/src/providers/openai.ts
+// ../../libs/workplans/src/providers/openai.ts
 var openai_exports = {};
 __export(openai_exports, {
   runOpenAIStep: () => runOpenAIStep
@@ -46,12 +46,12 @@ async function runOpenAIStep(opts) {
   return completion.choices[0]?.message.content ?? "";
 }
 var init_openai = __esm({
-  "../workplans/src/providers/openai.ts"() {
+  "../../libs/workplans/src/providers/openai.ts"() {
     "use strict";
   }
 });
 
-// ../workplans/src/providers/ollama.ts
+// ../../libs/workplans/src/providers/ollama.ts
 var ollama_exports = {};
 __export(ollama_exports, {
   runOllamaStep: () => runOllamaStep
@@ -64,12 +64,12 @@ async function runOllamaStep(opts) {
   return response.response;
 }
 var init_ollama = __esm({
-  "../workplans/src/providers/ollama.ts"() {
+  "../../libs/workplans/src/providers/ollama.ts"() {
     "use strict";
   }
 });
 
-// ../workplans/src/providers/shell.ts
+// ../../libs/workplans/src/providers/shell.ts
 var shell_exports = {};
 __export(shell_exports, {
   runShellStep: () => runShellStep
@@ -85,13 +85,13 @@ async function runShellStep(opts) {
 }
 var execAsync;
 var init_shell = __esm({
-  "../workplans/src/providers/shell.ts"() {
+  "../../libs/workplans/src/providers/shell.ts"() {
     "use strict";
     execAsync = promisify(exec);
   }
 });
 
-// ../workplans/src/providers/file.ts
+// ../../libs/workplans/src/providers/file.ts
 var file_exports = {};
 __export(file_exports, {
   runFileStep: () => runFileStep
@@ -101,12 +101,12 @@ async function runFileStep(opts) {
   return readFile(opts.path, opts.encoding ?? "utf8");
 }
 var init_file = __esm({
-  "../workplans/src/providers/file.ts"() {
+  "../../libs/workplans/src/providers/file.ts"() {
     "use strict";
   }
 });
 
-// ../dbos/src/scheduler.ts
+// ../../libs/dbos/src/scheduler.ts
 var scheduler_exports = {};
 __export(scheduler_exports, {
   registerDbosSchedulerTick: () => registerDbosSchedulerTick
@@ -126,13 +126,13 @@ function registerDbosSchedulerTick(scheduler) {
 }
 var registered;
 var init_scheduler = __esm({
-  "../dbos/src/scheduler.ts"() {
+  "../../libs/dbos/src/scheduler.ts"() {
     "use strict";
     registered = false;
   }
 });
 
-// ../dbos/src/index.ts
+// ../../libs/dbos/src/index.ts
 var src_exports = {};
 __export(src_exports, {
   DbosWorkflows: () => DbosWorkflows,
@@ -145,7 +145,7 @@ function createDbosWorkflows(store) {
 }
 var DbosWorkflows;
 var init_src = __esm({
-  "../dbos/src/index.ts"() {
+  "../../libs/dbos/src/index.ts"() {
     "use strict";
     init_scheduler();
     DbosWorkflows = class {
@@ -248,10 +248,33 @@ import { createServer } from "http";
 import { URL } from "url";
 import { ZodError } from "zod";
 
-// ../core/src/config.ts
+// ../../libs/core/src/auth.ts
+function parseBearerToken(authorizationHeader) {
+  if (!authorizationHeader) {
+    return void 0;
+  }
+  const match = /^Bearer\s+(.+)$/i.exec(authorizationHeader.trim());
+  return match?.[1];
+}
+function isAuthorizedBearer(provided, expected) {
+  if (!expected) {
+    return true;
+  }
+  if (!provided) {
+    return false;
+  }
+  return provided === expected;
+}
+function getRequestBearer(req) {
+  const header = req.headers.authorization;
+  const value = Array.isArray(header) ? header[0] : header;
+  return parseBearerToken(value);
+}
+
+// ../../libs/core/src/config.ts
 import { z } from "zod";
 
-// ../core/src/env.ts
+// ../../libs/core/src/env.ts
 import { config as dotenvConfig } from "dotenv";
 import { homedir } from "os";
 import { join } from "path";
@@ -266,7 +289,7 @@ function loadLocalEnv() {
   envLoaded = true;
 }
 
-// ../core/src/config.ts
+// ../../libs/core/src/config.ts
 loadLocalEnv();
 var serverEnvSchema = z.object({
   DATABASE_URL: z.string().optional().default("sqlite://~/.workplane/workplane.db"),
@@ -298,7 +321,13 @@ function parseCsv(value) {
   return value.split(",").map((entry) => entry.trim()).filter(Boolean);
 }
 
-// ../db/src/client.ts
+// ../../libs/core/src/ids.ts
+import { randomUUID } from "crypto";
+function makeId(prefix) {
+  return `${prefix}_${randomUUID().replace(/-/g, "").slice(0, 12)}`;
+}
+
+// ../../libs/db/src/client.ts
 import { mkdirSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname, join as join2 } from "path";
@@ -307,16 +336,10 @@ import { drizzle as drizzleSqlite } from "drizzle-orm/better-sqlite3";
 import Database from "better-sqlite3";
 import { Pool } from "pg";
 
-// ../db/src/pg-store.ts
+// ../../libs/db/src/pg-store.ts
 import { and, arrayContains, asc, desc, eq, gt, isNotNull, lte, sql as sql2 } from "drizzle-orm";
 
-// ../core/src/ids.ts
-import { randomUUID } from "crypto";
-function makeId(prefix) {
-  return `${prefix}_${randomUUID().replace(/-/g, "").slice(0, 12)}`;
-}
-
-// ../db/src/schema/pg.ts
+// ../../libs/db/src/schema/pg.ts
 var pg_exports = {};
 __export(pg_exports, {
   artifacts: () => artifacts,
@@ -444,7 +467,7 @@ var runInputEvents = pgTable("run_input_events", {
   undeliveredIdx: index("idx_run_input_events_undelivered").on(table.runId, table.sequence).where(isNull(table.deliveredAt))
 }));
 
-// ../db/src/pg-store.ts
+// ../../libs/db/src/pg-store.ts
 function toTaskRecord(row) {
   return {
     id: row.id,
@@ -616,6 +639,10 @@ var PgStore = class {
     }).returning();
     return toNodeRecord(inserted);
   }
+  async listNodes() {
+    const rows = await this.db.select().from(nodes).orderBy(asc(nodes.name));
+    return rows.map(toNodeRecord);
+  }
   async getRunCancellationState(runId) {
     const [row] = await this.db.select({ runStatus: runs.status, taskStatus: tasks.status }).from(runs).innerJoin(tasks, eq(tasks.id, runs.taskId)).where(eq(runs.id, runId));
     return row ?? null;
@@ -686,8 +713,8 @@ var PgStore = class {
     );
     return logs.length;
   }
-  async getRunLogs(runId) {
-    const rows = await this.db.select().from(runLogs).where(eq(runLogs.runId, runId)).orderBy(asc(runLogs.timestamp));
+  async getRunLogs(runId, afterId) {
+    const rows = await this.db.select().from(runLogs).where(afterId === void 0 ? eq(runLogs.runId, runId) : and(eq(runLogs.runId, runId), gt(runLogs.id, afterId))).orderBy(asc(runLogs.timestamp), asc(runLogs.id));
     return rows.map(toLogRecord);
   }
   async createArtifact(runId, input) {
@@ -872,10 +899,10 @@ var PgStore = class {
   }
 };
 
-// ../db/src/sqlite-store.ts
+// ../../libs/db/src/sqlite-store.ts
 import { and as and2, asc as asc2, desc as desc2, eq as eq2, gt as gt2, lte as lte2, sql as sql4 } from "drizzle-orm";
 
-// ../db/src/schema/sqlite.ts
+// ../../libs/db/src/schema/sqlite.ts
 var sqlite_exports = {};
 __export(sqlite_exports, {
   artifacts: () => artifacts2,
@@ -1004,7 +1031,7 @@ var runInputEvents2 = sqliteTable("run_input_events", {
   undeliveredIdx: index2("idx_run_input_events_undelivered").on(table.runId, table.sequence).where(isNull2(table.deliveredAt))
 }));
 
-// ../db/src/sqlite-store.ts
+// ../../libs/db/src/sqlite-store.ts
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -1195,6 +1222,10 @@ var SqliteStore = class {
     }).returning();
     return toNodeRecord2(inserted);
   }
+  async listNodes() {
+    const rows = await this.db.select().from(nodes2).orderBy(asc2(nodes2.name));
+    return rows.map(toNodeRecord2);
+  }
   async getRunCancellationState(runId) {
     const [row] = await this.db.select({ runStatus: runs2.status, taskStatus: tasks2.status }).from(runs2).innerJoin(tasks2, eq2(tasks2.id, runs2.taskId)).where(eq2(runs2.id, runId));
     return row ? { runStatus: row.runStatus, taskStatus: row.taskStatus ?? "" } : null;
@@ -1275,8 +1306,8 @@ var SqliteStore = class {
     );
     return logs.length;
   }
-  async getRunLogs(runId) {
-    const rows = await this.db.select().from(runLogs2).where(eq2(runLogs2.runId, runId)).orderBy(asc2(runLogs2.timestamp));
+  async getRunLogs(runId, afterId) {
+    const rows = await this.db.select().from(runLogs2).where(afterId === void 0 ? eq2(runLogs2.runId, runId) : and2(eq2(runLogs2.runId, runId), gt2(runLogs2.id, afterId))).orderBy(asc2(runLogs2.timestamp), asc2(runLogs2.id));
     return rows.map(toLogRecord2);
   }
   async createArtifact(runId, input) {
@@ -1468,7 +1499,7 @@ var SqliteStore = class {
   }
 };
 
-// ../db/src/client.ts
+// ../../libs/db/src/client.ts
 var pools = /* @__PURE__ */ new Map();
 function getPool(databaseUrl) {
   const existing = pools.get(databaseUrl);
@@ -1656,7 +1687,7 @@ function validateUpdateSchedule(body) {
   return updateScheduleSchema.parse(body);
 }
 
-// ../agent-skills/src/skills/code-review.ts
+// ../../libs/agent-skills/src/skills/code-review.ts
 function codeReviewPlan(opts = {}) {
   const { repoPath = ".", model = "claude-haiku-4-5-20251001", branch } = opts;
   const diffCmd = branch ? `git diff ${branch}..HEAD` : "git diff HEAD~1";
@@ -1693,7 +1724,7 @@ function codeReviewPlan(opts = {}) {
   };
 }
 
-// ../agent-skills/src/skills/hello.ts
+// ../../libs/agent-skills/src/skills/hello.ts
 function helloPlan(opts = {}) {
   const message = opts.message ?? "hello from workplane";
   return {
@@ -1712,7 +1743,7 @@ function helloPlan(opts = {}) {
   };
 }
 
-// ../agent-skills/src/skills/summarize-file.ts
+// ../../libs/agent-skills/src/skills/summarize-file.ts
 function summarizeFilePlan(opts) {
   const { filePath, provider = "ollama", model = "llama3" } = opts;
   return {
@@ -1739,7 +1770,7 @@ function summarizeFilePlan(opts) {
   };
 }
 
-// ../agent-skills/src/skills/index.ts
+// ../../libs/agent-skills/src/skills/index.ts
 var SkillRegistry = class {
   skills = /* @__PURE__ */ new Map();
   register(entry) {
@@ -1757,6 +1788,12 @@ function createDefaultRegistry() {
   registry.register({
     name: "hello",
     description: "Shell echo (scheduler smoke test)",
+    inputSchema: {
+      type: "object",
+      properties: {
+        message: { type: "string", description: "Text to echo", default: "hello from workplane" }
+      }
+    },
     buildPlan: (opts) => helloPlan({
       message: typeof opts.message === "string" ? opts.message : void 0
     })
@@ -1764,6 +1801,14 @@ function createDefaultRegistry() {
   registry.register({
     name: "code-review",
     description: "Git diff \u2192 local summarize (ollama) \u2192 frontier critique (anthropic)",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo: { type: "string", description: "Path to the git repository" },
+        model: { type: "string", description: "Model used for the local summarize step" },
+        branch: { type: "string", description: "Branch to diff against" }
+      }
+    },
     buildPlan: (opts) => codeReviewPlan({
       repoPath: typeof opts.repo === "string" ? opts.repo : void 0,
       model: typeof opts.model === "string" ? opts.model : void 0,
@@ -1773,6 +1818,15 @@ function createDefaultRegistry() {
   registry.register({
     name: "summarize-file",
     description: "Read file \u2192 summarize with configurable provider (default: ollama)",
+    inputSchema: {
+      type: "object",
+      properties: {
+        file: { type: "string", description: "Path of the file to summarize" },
+        provider: { type: "string", description: "Model provider", default: "ollama" },
+        model: { type: "string", description: "Model name" }
+      },
+      required: ["file"]
+    },
     buildPlan: (opts) => {
       const filePath = typeof opts.file === "string" ? opts.file : "";
       if (!filePath) throw new Error("--file is required for summarize-file");
@@ -1786,77 +1840,7 @@ function createDefaultRegistry() {
   return registry;
 }
 
-// ../workplans/src/sinks/stdout.ts
-function printStepResult(stepName, output) {
-  process.stdout.write(`=== step: ${stepName} ===
-${output}
-
-`);
-}
-
-// ../workplans/src/context.ts
-var WorkplaneNodeHandle = class {
-  constructor(serverUrl, nodeToken) {
-    this.serverUrl = serverUrl;
-    this.nodeToken = nodeToken;
-  }
-  serverUrl;
-  nodeToken;
-  async execute(step) {
-    const start = Date.now();
-    const taskRes = await fetch(`${this.serverUrl}/tasks`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${this.nodeToken}`
-      },
-      body: JSON.stringify({
-        kind: "workplan.step",
-        adapter: step.adapter,
-        payload: step.payload,
-        requires: step.requires ?? []
-      })
-    });
-    if (!taskRes.ok) {
-      throw new Error(`failed to submit step ${step.id}: ${taskRes.status}`);
-    }
-    const task = await taskRes.json();
-    const output = await this.pollUntilDone(task.id);
-    return { stepId: step.id, output, exitCode: 0, durationMs: Date.now() - start };
-  }
-  async pollUntilDone(taskId) {
-    const terminalStatuses = /* @__PURE__ */ new Set(["succeeded", "failed", "cancelled"]);
-    for (; ; ) {
-      await new Promise((r) => setTimeout(r, 1e3));
-      const res = await fetch(`${this.serverUrl}/tasks/${taskId}`, {
-        headers: { authorization: `Bearer ${this.nodeToken}` }
-      });
-      const task = await res.json();
-      if (terminalStatuses.has(task.status)) {
-        if (task.status !== "succeeded") {
-          throw new Error(`step task ${taskId} ended with status: ${task.status}`);
-        }
-        return typeof task.payload?.output === "string" ? task.payload.output : "";
-      }
-    }
-  }
-};
-var LocalWorkplanContext = class {
-  serverUrl;
-  nodeToken;
-  constructor(opts = {}) {
-    this.serverUrl = opts.serverUrl ?? process.env.WORKPLANE_SERVER_URL ?? "http://localhost:8787";
-    this.nodeToken = opts.nodeToken ?? process.env.WORKPLANE_NODE_TOKEN ?? "";
-  }
-  async resolveNode(_requires, _provider) {
-    return new WorkplaneNodeHandle(this.serverUrl, this.nodeToken);
-  }
-  emitResult(_stepId, stepName, output) {
-    printStepResult(stepName, output);
-  }
-};
-
-// ../workplans/src/template.ts
+// ../../libs/workplans/src/template.ts
 function applyTemplate(payload, prevOutput) {
   return Object.fromEntries(
     Object.entries(payload).map(([k, v]) => [
@@ -1866,7 +1850,7 @@ function applyTemplate(payload, prevOutput) {
   );
 }
 
-// ../workplans/src/runner.ts
+// ../../libs/workplans/src/runner.ts
 var INLINE_PROVIDERS = /* @__PURE__ */ new Set(["anthropic", "openai", "ollama", "shell", "file"]);
 async function runInlineStep(step, prompt) {
   const provider = step.provider;
@@ -1962,7 +1946,77 @@ var SequentialWorkplanRunner = class {
   }
 };
 
-// ../workplans/src/schedule-builder.ts
+// ../../libs/workplans/src/sinks/stdout.ts
+function printStepResult(stepName, output) {
+  process.stdout.write(`=== step: ${stepName} ===
+${output}
+
+`);
+}
+
+// ../../libs/workplans/src/context.ts
+var WorkplaneNodeHandle = class {
+  constructor(serverUrl, nodeToken) {
+    this.serverUrl = serverUrl;
+    this.nodeToken = nodeToken;
+  }
+  serverUrl;
+  nodeToken;
+  async execute(step) {
+    const start = Date.now();
+    const taskRes = await fetch(`${this.serverUrl}/tasks`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${this.nodeToken}`
+      },
+      body: JSON.stringify({
+        kind: "workplan.step",
+        adapter: step.adapter,
+        payload: step.payload,
+        requires: step.requires ?? []
+      })
+    });
+    if (!taskRes.ok) {
+      throw new Error(`failed to submit step ${step.id}: ${taskRes.status}`);
+    }
+    const task = await taskRes.json();
+    const output = await this.pollUntilDone(task.id);
+    return { stepId: step.id, output, exitCode: 0, durationMs: Date.now() - start };
+  }
+  async pollUntilDone(taskId) {
+    const terminalStatuses = /* @__PURE__ */ new Set(["succeeded", "failed", "cancelled"]);
+    for (; ; ) {
+      await new Promise((r) => setTimeout(r, 1e3));
+      const res = await fetch(`${this.serverUrl}/tasks/${taskId}`, {
+        headers: { authorization: `Bearer ${this.nodeToken}` }
+      });
+      const task = await res.json();
+      if (terminalStatuses.has(task.status)) {
+        if (task.status !== "succeeded") {
+          throw new Error(`step task ${taskId} ended with status: ${task.status}`);
+        }
+        return typeof task.payload?.output === "string" ? task.payload.output : "";
+      }
+    }
+  }
+};
+var LocalWorkplanContext = class {
+  serverUrl;
+  nodeToken;
+  constructor(opts = {}) {
+    this.serverUrl = opts.serverUrl ?? process.env.WORKPLANE_SERVER_URL ?? "http://localhost:8787";
+    this.nodeToken = opts.nodeToken ?? process.env.WORKPLANE_NODE_TOKEN ?? "";
+  }
+  async resolveNode(_requires, _provider) {
+    return new WorkplaneNodeHandle(this.serverUrl, this.nodeToken);
+  }
+  emitResult(_stepId, stepName, output) {
+    printStepResult(stepName, output);
+  }
+};
+
+// ../../libs/workplans/src/schedule-builder.ts
 import { CronExpressionParser } from "cron-parser";
 var ScheduleBuilder = class _ScheduleBuilder {
   static nextRunAt(cronExpression, timezone) {
@@ -1977,7 +2031,7 @@ var ScheduleBuilder = class _ScheduleBuilder {
   }
 };
 
-// ../workplans/src/scheduler.ts
+// ../../libs/workplans/src/scheduler.ts
 var WorkplanScheduler = class {
   constructor(store, resolver, contextFactory, runner = new SequentialWorkplanRunner()) {
     this.store = store;
@@ -2055,6 +2109,13 @@ var WorkplanScheduler = class {
 
 // ../server/src/schedule-service.ts
 var skillRegistry = createDefaultRegistry();
+function listSkillSummaries() {
+  return skillRegistry.list().map((skill) => ({
+    name: skill.name,
+    description: skill.description,
+    inputSchema: skill.inputSchema ?? { type: "object", properties: {} }
+  }));
+}
 function createWorkplanScheduler(store) {
   return new WorkplanScheduler(
     store,
@@ -2123,29 +2184,6 @@ function listKnownPlanIds() {
   return skillRegistry.list().map((skill) => skill.name);
 }
 
-// ../core/src/auth.ts
-function parseBearerToken(authorizationHeader) {
-  if (!authorizationHeader) {
-    return void 0;
-  }
-  const match = /^Bearer\s+(.+)$/i.exec(authorizationHeader.trim());
-  return match?.[1];
-}
-function isAuthorizedBearer(provided, expected) {
-  if (!expected) {
-    return true;
-  }
-  if (!provided) {
-    return false;
-  }
-  return provided === expected;
-}
-function getRequestBearer(req) {
-  const header = req.headers.authorization;
-  const value = Array.isArray(header) ? header[0] : header;
-  return parseBearerToken(value);
-}
-
 // ../server/src/auth-middleware.ts
 function checkRouteAuth(req, res, auth, config) {
   const bearer = getRequestBearer(req);
@@ -2161,6 +2199,16 @@ function checkRouteAuth(req, res, auth, config) {
     }
     return true;
   }
+  if (auth === "read") {
+    const accepted = [config.operatorToken, config.nodeToken].some((token) => token && bearer === token);
+    if (!accepted) {
+      res.statusCode = 401;
+      res.setHeader("content-type", "application/json");
+      res.end(JSON.stringify({ error: "unauthorized read request" }));
+      return false;
+    }
+    return true;
+  }
   if (auth === "operator") {
     if (!isAuthorizedBearer(bearer, config.operatorToken)) {
       res.statusCode = 401;
@@ -2172,7 +2220,14 @@ function checkRouteAuth(req, res, auth, config) {
   }
   return true;
 }
-function routeAuthFor(method, pathname) {
+function routeAuthFor(method, pathname, options = {}) {
+  const auth = baseRouteAuthFor(method, pathname);
+  if (options.protectReads && auth === "public" && method === "GET" && pathname !== "/healthz") {
+    return "read";
+  }
+  return auth;
+}
+function baseRouteAuthFor(method, pathname) {
   if (pathname === "/healthz") {
     return "public";
   }
@@ -2192,7 +2247,7 @@ function routeAuthFor(method, pathname) {
     return "node";
   }
   if (method === "GET" && /^\/runs\/[^/]+\/input$/.test(pathname)) {
-    return "node";
+    return "read";
   }
   if (method === "POST" && /^\/runs\/[^/]+\/input\/\d+\/delivered$/.test(pathname)) {
     return "node";
@@ -2233,6 +2288,40 @@ function requiresConfiguredToken(auth, config) {
   if (auth === "operator") {
     return Boolean(config.operatorToken);
   }
+  if (auth === "read") {
+    return Boolean(config.operatorToken || config.nodeToken);
+  }
+  return false;
+}
+
+// ../server/src/cors.ts
+function parseCorsOrigins(value) {
+  const entries = (value ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+  if (entries.length === 0) {
+    return null;
+  }
+  return { allowAll: entries.includes("*"), origins: new Set(entries) };
+}
+function applyCors(req, res, config) {
+  if (!config) {
+    return false;
+  }
+  const origin = req.headers.origin;
+  const allowed = typeof origin === "string" && (config.allowAll || config.origins.has(origin));
+  if (allowed) {
+    res.setHeader("access-control-allow-origin", config.allowAll ? "*" : origin);
+    res.setHeader("vary", "Origin");
+  }
+  if (req.method === "OPTIONS" && typeof req.headers["access-control-request-method"] === "string") {
+    if (allowed) {
+      res.setHeader("access-control-allow-methods", "GET,POST,PATCH,DELETE,OPTIONS");
+      res.setHeader("access-control-allow-headers", "authorization,content-type");
+      res.setHeader("access-control-max-age", "600");
+    }
+    res.statusCode = allowed ? 204 : 403;
+    res.end();
+    return true;
+  }
   return false;
 }
 
@@ -2290,14 +2379,24 @@ async function main() {
   if (process.env.WORKPLANE_USE_DBOS !== "true" && isSchedulerEnabled()) {
     stopSchedulerLoop = startSchedulerLoop(scheduler);
   }
+  const corsConfig = parseCorsOrigins(process.env.WORKPLANE_CORS_ORIGINS);
+  const protectReads = process.env.WORKPLANE_PROTECT_READS === "true";
+  if (protectReads && !(config.operatorToken || config.nodeToken)) {
+    process.stderr.write("WORKPLANE_PROTECT_READS=true has no effect: set WORKPLANE_OPERATOR_TOKEN (and WORKPLANE_NODE_TOKEN) first\n");
+  } else if (protectReads && !config.nodeToken) {
+    process.stderr.write("WORKPLANE_PROTECT_READS=true: also set WORKPLANE_NODE_TOKEN, nodes read /runs/:id and /tasks/:id without a token otherwise\n");
+  }
   const server = createServer(async (req, res) => {
     try {
       if (!req.url || !req.method) {
         writeJson(res, 400, { error: "invalid request" });
         return;
       }
+      if (applyCors(req, res, corsConfig)) {
+        return;
+      }
       const url = new URL(req.url, "http://localhost");
-      const routeAuth = routeAuthFor(req.method, url.pathname);
+      const routeAuth = routeAuthFor(req.method, url.pathname, { protectReads });
       const authConfig = { nodeToken: config.nodeToken, operatorToken: config.operatorToken };
       if (requiresConfiguredToken(routeAuth, authConfig) && !checkRouteAuth(req, res, routeAuth, authConfig)) {
         return;
@@ -2373,7 +2472,13 @@ async function main() {
       }
       if (req.method === "GET" && /^\/runs\/[^/]+\/logs$/.test(url.pathname)) {
         const runId = url.pathname.split("/")[2];
-        const logs = await store.getRunLogs(runId);
+        const afterIdParam = url.searchParams.get("afterId");
+        const afterId = afterIdParam === null ? void 0 : Number(afterIdParam);
+        if (afterId !== void 0 && (!Number.isInteger(afterId) || afterId < 0)) {
+          writeJson(res, 400, { error: "afterId must be a non-negative integer" });
+          return;
+        }
+        const logs = await store.getRunLogs(runId, afterId);
         writeJson(res, 200, { logs });
         return;
       }
@@ -2383,6 +2488,11 @@ async function main() {
         writeJson(res, 200, { artifacts: artifacts3 });
         return;
       }
+      if (req.method === "GET" && url.pathname === "/nodes") {
+        const nodes3 = await store.listNodes();
+        writeJson(res, 200, { nodes: nodes3 });
+        return;
+      }
       if (req.method === "POST" && url.pathname === "/nodes/register") {
         const body = await readJson(req);
         const node = await store.registerNode(body.name, body.capabilities ?? [], body.nodeId);
@@ -2453,6 +2563,10 @@ async function main() {
         writeJson(res, 200, { ok: true });
         return;
       }
+      if (req.method === "GET" && url.pathname === "/skills") {
+        writeJson(res, 200, { skills: listSkillSummaries() });
+        return;
+      }
       if (req.method === "GET" && url.pathname === "/plans") {
         writeJson(res, 200, { plans: listKnownPlanIds() });
         return;