package.json

{
  "name": "@mavis/webui",
  "version": "2.0.0",
  "private": true,
  "type": "module",
  "description": "Browser frontend for MiniMax Code. Serves the web chat UI over HTTP/SSE and drives the mcode engine (ACP over stdio). Migrated from the mcode-webui community plugin (PR #55 of MiniMax-Code-Plugins) into the product as a first-class package.",
  "main": "server.js",
  "scripts": {
    "start": "node server.js",
    "dev": "node server.js",
    "webapp:dev": "next dev webapp --port 18091",
    "webapp:build": "next build webapp",
    "webapp:typecheck": "tsc -p webapp/tsconfig.json --noEmit",
    "test:webapp": "node --import tsx --import ./test/helpers/mavis-sources.mjs --test \"webapp/test/**/*.test.ts\"",
    "test": "node --import tsx --import ./test/helpers/mavis-sources.mjs --experimental-test-module-mocks --test test/lib/*.test.js test/lib/*.check.mjs test/lib/*/*.test.js test/lib/*/*.check.mjs test/routes/*.test.js test/routes/*.check.mjs test/server/*.test.js test/server/*.check.mjs test/tooling/*.test.js test/integration/*.test.js test/matrix/*.test.js test/trajectory/*.mjs",
    "test:unit": "node --import tsx --import ./test/helpers/mavis-sources.mjs --experimental-test-module-mocks --test test/lib/*.test.js test/lib/*/*.test.js test/routes/*.test.js test/server/*.test.js test/tooling/*.test.js",
    "test:mocked": "node --import tsx --import ./test/helpers/mavis-sources.mjs --experimental-test-module-mocks --test test/lib/*.check.mjs test/lib/*/*.check.mjs test/routes/*.check.mjs test/server/*.check.mjs",
    "test:integration": "node --import tsx --import ./test/helpers/mavis-sources.mjs --experimental-test-module-mocks --test test/integration/*.test.js test/matrix/*.test.js",
    "check": "node scripts/check-docs-alignment.mjs",
    "check:ci": "node scripts/check-docs-alignment.mjs --ci",
    "sbom": "node scripts/gen-sbom.mjs",
    "trajectory:doctor": "node server/trajectory/main.mjs --doctor",
    "trajectory:serve": "node server/trajectory/main.mjs --serve",
    "test:trajectory": "node --import tsx --import ./test/helpers/mavis-sources.mjs --test test/trajectory/*.mjs"
  },
  "engines": {
    "node": ">=22.19 <23 || >=24.2 <27"
  },
  "devDependencies": {
    "@ant-design/nextjs-registry": "1.3.0",
    "@types/node": "26.6.2",
    "@types/react": "18.3.31",
    "@types/react-dom": "18.3.7",
    "antd": "5.29.3",
    "autoprefixer": "10.6.1",
    "happy-dom": "20.14.5",
    "highlight.js": "10.7.3",
    "katex": "0.18.7",
    "marked": "18.0.12",
    "mermaid": "11.12.1",
    "next": "14.2.35",
    "postcss": "8.5.28",
    "react": "18.3.1",
    "react-dom": "18.3.1",
    "tailwindcss": "3.4.19",
    "typescript": "5.9.3"
  },
  "mcodeWebui": {
    "defaultPort": 18090,
    "dataDir": "~/.mcode-webui",
    "history": "Originally the mcode-webui plugin by Wzdhehe et al.; see co-builders.md at the repository root.",
    "capabilities": [
      {
        "name": "chat-streaming",
        "description": "Streams model output token-by-token from the mcode acp subprocess via Server-Sent Events (`GET /api/events`). Each delta event includes `text` and `isPartial` so the browser can render progressive assistant replies without buffering the full response."
      },
      {
        "name": "tool-execution",
        "description": "Forwards Bash, Read, Write, Edit, and other tool-call events from the mcode acp JSON-RPC stream to the chat UI. Tool output auto-collapses on completion; per-tool permission prompts are surfaced as a modal (see `permission-prompts`)."
      },
      {
        "name": "plan-mode",
        "description": "Renders the engine's `plan_update` event as a READ-ONLY, dismissible plan notice showing the plan document. It carries no decision buttons: a plan review is a runtime questionnaire answered on the local-runtime channel, which this package does not speak, so webui has no way to accept, skip, or annotate a plan. It previously offered Agree / Add context / Skip and posted them to `POST /api/answer`, which answered `200 {ok:true}` without reaching the engine — the buttons were a fake capability and are gone."
      },
      {
        "name": "ask-user-tool",
        "description": "Renders the ask_user dialog as a modal question with 2-4 options, optional multi-select checkboxes, a free-text 'Other' field, and a Skip button. Every one of them — options, free text, and Skip — is sent back through `POST /api/send` with `isAskAnswer: true`, the only ask path the engine receives. Skip used to post to `POST /api/answer`, a legacy no-op."
      },
      {
        "name": "permission-prompts",
        "description": "The webui's own destructive-action confirmations (session delete, token reset, and the other actions in `server/lib/authorize.js#AUTHORIZE_ACTIONS`) surface as a modal and are answered via `POST /api/auth/decision {requestId, approve}`. This is a webui-local gate. The ENGINE's tool-permission prompt is a separate runtime `permission.ask` and is NOT answered by webui: it would arrive as an incoming `session/requestPermission` ACP request, and this package's ACP client emits it with no responder."
      },
      {
        "name": "workspace-switching",
        "description": "Workspace picker backed by `POST /api/workspace` and `GET /api/workspace/browse`. Recents list persists in `localStorage`; the last-used workspace is restored on reload. Per-workspace git status (branch / dirty) is shown best-effort."
      },
      {
        "name": "session-management",
        "description": "List, create, switch, and delete webui sessions via `/api/sessions`. Deleting a session also cross-deletes the linked mcode row from `~/.minimax/v2/sqlite/runtime-state.sqlite` in a single transaction. Pass `?dryRun=true` to preview."
      },
      {
        "name": "file-attachments",
        "description": "Upload files via `POST /api/upload` (multipart), saved to `MCODE_WEBUI_UPLOAD_DIR`. Drag-and-drop, click-to-upload, and Ctrl+V paste are wired in the chat UI. The server injects `@absolute-path` references into the prompt."
      },
      {
        "name": "quota-usage",
        "description": "Displays `mmx quota show` data (remaining quota, time-until-reset for the 5-hour and weekly windows) plus per-turn `lastTurnContextTokens` read from the mavis runtime sqlite. Refreshes silently every 2 minutes or on demand via the 'refresh' button."
      },
      {
        "name": "bilingual-ui",
        "description": "All user-visible strings go through `I18N.zh` / `I18N.en` lookup tables with `t(key)`. The locale toggle in the top-bar switches the entire UI; 22+ keys were added in v1.0.1 for the LAN settings sub-card."
      },
      {
        "name": "lan-sharing",
        "description": "Binds loopback `127.0.0.1:18090` by default; LAN exposure is an explicit opt-in — the `HOST` env var or the persisted `lanBind` setting (`POST /api/settings {lanBind: true}`, effective on restart). A runtime toggle (`POST /api/settings {lanBroadcast: false}`) additionally closes the LAN gate with a bilingual 403 page. The settings snapshot discloses the live exposure via `lanExposed` / `bindRestartPending` / `lanExposureNotice`."
      },
      {
        "name": "token-auth",
        "description": "When `TOKEN` env is set (or the server auto-generates a 32-hex token on first start with no env set), all non-local requests to `/api/*` must include `?token=<value>` or `Authorization: Bearer <value>`. Local requests always bypass. The token can be rotated live from the settings card."
      },
      {
        "name": "git-panel",
        "description": "Right-panel Git surface (slice 03 of webui-parity): workspace status (branch + upstream + per-file porcelain), local-branch list, single-file diff against HEAD with a no-index fallback for untracked files, and a destructive branch switch gated by a local-branch allow-list. All `git` invocations go through `execFile` (no shell) and every `dir` is checked by the shared `assertWorkspacePath` containment gate; an out-of-root directory answers `{ok:false, isRepo:false}` and the panel renders an empty state rather than an error."
      },
      {
        "name": "mobile-responsive",
        "description": "Layout adapts at <900px (drawer pattern for the sidebar and right panel) and collapses to a single column at <600px. Dark mode follows `prefers-color-system` at boot. Touch targets and font sizes are tuned for phone use."
      }
    ],
    "endpoints": {
      "health": "GET /api/health",
      "events": "GET /api/events (SSE)",
      "state": "GET /api/state",
      "sessions": "GET|POST|DELETE /api/sessions[/:id|/switch]",
      "chat": "POST /api/send|stop|cmd",
      "workspace": "GET|POST /api/workspace[?/browse]",
      "settings": "GET|POST /api/settings",
      "upload": "POST /api/upload",
      "model": "GET /api/models, POST /api/set-model|permissions, POST /api/answer (410 tombstone — removed capability)",
      "providers": "GET|PUT /api/providers, POST /api/providers/test, GET /api/providers/presets, POST /api/providers/preset/:id/enable",
      "usage": "GET|POST /api/usage[-real|-trigger|/refresh]",
      "git": "GET /api/git/status|branches|diff, POST /api/git/checkout",
      "protocol": "GET|POST /api/protocol/* (acp shim)",
      "engineCapabilities": "GET /api/engine-capabilities (14-key engine provider capability declaration + degradation summary; ?provider= selects, unknown ids answer 404)",
      "debug": "GET|POST /api/debug/* (DEBUG_INJECT gated)"
    }
  },
  "license": "MIT",
  "dependencies": {
    "@hono/node-server": "^2.1.1",
    "@mavis/shared": "workspace:*",
    "hono": "^4.7.11"
  }
}