@muninhq/studio

Munin Studio — the local, single-user, open-source visual front door to your Munin memory. Drag documents in, watch the knowledge graph build, browse what you've added, and read any source back with its provenance intact.

Studio is a client of the munin serve doorman. The doorman is the one process that opens the local PGlite store; it exposes the engine reads Studio needs over a loopback-only (127.0.0.1) HTTP API with a bearer token. Studio never opens the store directly and never bypasses permissions — every byte of data on screen came through the doorman under a normal, fail-closed read context.

  munin serve   (the ONE store opener: holds the lock, owns PGlite)
        ▲ 127.0.0.1 + bearer token (serve.json, 0600)
  Munin Studio   (this Next.js app — server components read the doorman)
        ▲ your browser, on this machine
      You

Running

munin studio          # starts (or attaches to) the doorman, boots Studio, opens the browser

From an npm install, munin studio runs this package's published standalone production server (standalone/server.js — a built Next server assembled by scripts/build-standalone.mjs; no compile at launch, no repo needed). From a source checkout it falls back to next dev; set MUNIN_STUDIO_DEV=1 to force dev mode even when a standalone build exists. Useful flags: --port <n> pins the port, --no-open skips the browser.

Or, against a doorman you started yourself:

munin serve &         # in one terminal
pnpm --filter @muninhq/studio dev   # in another (reads $MUNIN_HOME/serve.json)

Security — the local trust model

Two locks, one per hop, both scoped to the OS user who runs Munin:

• The doorman (munin serve) requires its bearer token on every request. The token is minted per host boot and written to $MUNIN_HOME/serve.json at mode 0600 — the filesystem is the user boundary; another local user cannot read it.
• Studio's own HTTP surface requires a per-boot session cookie. munin studio mints a random secret, hands it to the Studio server via env, and opens your browser at /?auth=<secret> — Studio's proxy exchanges that for an httpOnly, SameSite=Strict cookie and redirects to the clean URL. The unlock link is single-use (it transits the browser-opener's process arguments, which other local users can list — so the first redemption burns it; re-run munin studio to unlock another browser or profile). The secret is delivered only out-of-band (terminal + the opened URL); it is never issued over HTTP, and the doorman token is never reused as the cookie or exposed to the browser (src/lib/studio-host-client.ts is server-only). Every request — pages and /api/*, reads and writes — is checked (constant-time compare); anything without the cookie gets a content-free 401 (a minimal locked page for pages, enforced in the proxy AND mirrored in the app layout as matcher-drift insurance). The Host header must be loopback (127.0.0.1 / localhost / [::1], with the expected port when known), which closes DNS rebinding; browser-marked cross-site requests stay rejected as CSRF defence-in-depth.

Net effect on a shared machine: another local user who can reach Studio's port can neither read your memory nor upload/erase/change settings through it. For scripts, the supported surface is the doorman's token-gated API directly — not Studio's port. Running the server by hand (next dev, node standalone/server.js) without the launcher derives the session secret from the doorman token (SHA-256, one-way) and prints an unlock link on the first locked page load.

Packaging & egress posture

The published tarball ships standalone/ only — server.js + the production .next build (static assets copied in per Next's standalone contract) and no bundled node_modules: next/react/react-dom are exact-pinned real dependencies resolved from your install. Builds and the spawned runtime set NEXT_TELEMETRY_DISABLED=1, fonts are self-hosted (next/font/local, vendored OFL woff2 — no Google Fonts fetch), and the shipped server's default bind is 127.0.0.1 (the build patches Next's generated 0.0.0.0 default; setting HOSTNAME yourself is an explicit opt-out). A munin studio session makes no non-loopback requests.

Licensing

This package is part of Munin's open core and is released under the GNU Affero General Public License v3.0 only (AGPL-3.0-only). See the LICENSE file. The hosted/managed product, teams, device sync, and the vertical configurations are a separate, closed commercial product.

Status

Read and write surfaces are live against the doorman: overview stats, the document list and reader, the Mind (Orrery), upload/ingest with progress, delete/erase, and provider/key settings — all through the authenticated proxy routes described above.