@abdasis/agentdeck 2.44.2

package/agent/dist/logger.js

@@ -0,0 +1,39 @@
+import pino from 'pino';
+// Get log level from environment or default to 'info'
+const level = process.env.LOG_LEVEL || 'info';
+// Check if we're in development mode (for pretty printing)
+const isDev = process.env.NODE_ENV !== 'production';
+// Create base logger
+const baseLogger = pino({
+    level,
+    ...(isDev && {
+        transport: {
+            target: 'pino-pretty',
+            options: {
+                colorize: true,
+                translateTime: 'HH:MM:ss',
+                ignore: 'pid,hostname',
+            },
+        },
+    }),
+});
+// Create child loggers for each module
+export const logger = {
+    // Main logger for generic messages
+    main: baseLogger,
+    // Server/API related logs
+    server: baseLogger.child({ module: 'Server' }),
+    // Database related logs
+    db: baseLogger.child({ module: 'DB' }),
+    // Session management logs
+    session: baseLogger.child({ module: 'Session' }),
+    // Terminal/PTY related logs
+    terminal: baseLogger.child({ module: 'Terminal' }),
+    // Environment management logs
+    env: baseLogger.child({ module: 'Environments' }),
+    // Connection management logs
+    connections: baseLogger.child({ module: 'Connections' }),
+    // Hook status logs
+    hooks: baseLogger.child({ module: 'Hooks' }),
+};
+//# sourceMappingURL=logger.js.map

package/agent/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,sDAAsD;AACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;AAE9C,2DAA2D;AAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAEpD,qBAAqB;AACrB,MAAM,UAAU,GAAG,IAAI,CAAC;IACtB,KAAK;IACL,GAAG,CAAC,KAAK,IAAI;QACX,SAAS,EAAE;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,UAAU;gBACzB,MAAM,EAAE,cAAc;aACvB;SACF;KACF,CAAC;CACH,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,mCAAmC;IACnC,IAAI,EAAE,UAAU;IAEhB,0BAA0B;IAC1B,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE9C,wBAAwB;IACxB,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEtC,0BAA0B;IAC1B,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEhD,4BAA4B;IAC5B,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAElD,8BAA8B;IAC9B,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAEjD,6BAA6B;IAC7B,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAExD,mBAAmB;IACnB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;CAC7C,CAAC"}

package/agent/dist/middleware/auth.d.ts

@@ -0,0 +1,15 @@
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Validasi token terhadap accessToken agent. True bila agent belum set
+ * accessToken (opt-in, install lama) ATAU token cocok. Dipakai middleware HTTP
+ * dan handshake WS upgrade.
+ */
+export declare function authenticateToken(provided: string | undefined): boolean;
+/**
+ * Auth middleware per-machine. Bila agent belum punya accessToken (install
+ * lama pre-auth) → allow semua (opt-in). Bila accessToken ada → wajib token
+ * yang cocok. Dipasang di router projects + sessions. Pairing/health/hooks
+ * tidak pakai middleware ini.
+ */
+export declare function authMiddleware(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=auth.d.ts.map

package/agent/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAiC/D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAMpF"}

package/agent/dist/middleware/auth.js

@@ -0,0 +1,55 @@
+import { timingSafeEqual } from 'crypto';
+import { getAccessToken } from '../config.js';
+/**
+ * Bandingkan dua string constant-time. Panjang beda → tetap bandingkan ke
+ * buffer sepanjang expected lalu return false (hindari length leak via early
+ * return).
+ */
+function safeEqual(a, b) {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length) {
+        // Bandingkan aBuf dengan dirinya sendiri agar waktu tetap konsisten.
+        timingSafeEqual(aBuf, aBuf);
+        return false;
+    }
+    return timingSafeEqual(aBuf, bBuf);
+}
+/**
+ * Ambil token dari query `?token=` atau header `Authorization: Bearer ...`.
+ */
+function extractToken(req) {
+    const q = req.query?.token;
+    if (typeof q === 'string' && q)
+        return q;
+    const auth = req.headers.authorization;
+    if (typeof auth === 'string' && auth.toLowerCase().startsWith('bearer ')) {
+        return auth.slice(7).trim();
+    }
+    return undefined;
+}
+/**
+ * Validasi token terhadap accessToken agent. True bila agent belum set
+ * accessToken (opt-in, install lama) ATAU token cocok. Dipakai middleware HTTP
+ * dan handshake WS upgrade.
+ */
+export function authenticateToken(provided) {
+    const expected = getAccessToken();
+    if (!expected)
+        return true;
+    return !!provided && safeEqual(provided, expected);
+}
+/**
+ * Auth middleware per-machine. Bila agent belum punya accessToken (install
+ * lama pre-auth) → allow semua (opt-in). Bila accessToken ada → wajib token
+ * yang cocok. Dipasang di router projects + sessions. Pairing/health/hooks
+ * tidak pakai middleware ini.
+ */
+export function authMiddleware(req, res, next) {
+    if (authenticateToken(extractToken(req))) {
+        next();
+        return;
+    }
+    res.status(401).json({ error: 'Unauthorized: invalid or missing access token' });
+}
+//# sourceMappingURL=auth.js.map

package/agent/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,qEAAqE;QACrE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B;IAC5D,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC5E,IAAI,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;AACnF,CAAC"}

package/agent/dist/routes/commands.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Project commands API: CRUD definitions + start/stop/restart running commands.
+ * Definition disimpan di SQLite project_commands; running instance = tmux session
+ * + sessions row ber-command_id.
+ */
+import { Router } from 'express';
+export declare function createCommandRoutes(): Router;
+//# sourceMappingURL=commands.d.ts.map

package/agent/dist/routes/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/routes/commands.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAiEjC,wBAAgB,mBAAmB,IAAI,MAAM,CA+K5C"}

package/agent/dist/routes/commands.js

@@ -0,0 +1,229 @@
+/**
+ * Project commands API: CRUD definitions + start/stop/restart running commands.
+ * Definition disimpan di SQLite project_commands; running instance = tmux session
+ * + sessions row ber-command_id.
+ */
+import { Router } from 'express';
+import * as path from 'path';
+import { config } from '../config.js';
+import * as commandsDb from '../db/commands.js';
+import { insertCommandSession, deleteSession } from '../db/sessions.js';
+import { generateCommandSessionName, spawnCommandSession, killCommandSession, hasCommandSession, } from '../lib/command-session.js';
+import { broadcastSessionsList, broadcastSessionRemoved } from '../websocket-handlers.js';
+import { authMiddleware } from '../middleware/auth.js';
+function resolveBasePath() {
+    return config.projects.basePath.replace('~', process.env.HOME || '~');
+}
+/** Path absolut folder project; null jika di luar basePath (path traversal). */
+function projectPath(project) {
+    const basePath = resolveBasePath();
+    const full = path.join(basePath, project);
+    const rel = path.relative(basePath, full);
+    if (rel.startsWith('..') || path.isAbsolute(rel))
+        return null;
+    return full;
+}
+/** Resolve cwd: default = folder project; null jika di luar project path. */
+function resolveCwd(project, cwdOverride) {
+    const base = projectPath(project);
+    if (!base)
+        return null;
+    if (!cwdOverride)
+        return base;
+    const full = path.isAbsolute(cwdOverride) ? cwdOverride : path.join(base, cwdOverride);
+    const rel = path.relative(base, full);
+    if (rel.startsWith('..'))
+        return null;
+    return full;
+}
+function toWire(cmd) {
+    if (!cmd)
+        return null;
+    const runState = {
+        sessionName: cmd.runState.sessionName,
+        status: cmd.runState.status ?? null,
+        lastActivity: cmd.runState.lastActivity,
+    };
+    return {
+        id: cmd.id,
+        project: cmd.project,
+        name: cmd.name,
+        command: cmd.command,
+        cwd: cmd.cwd,
+        position: cmd.position,
+        createdAt: cmd.created_at,
+        updatedAt: cmd.updated_at,
+        runState,
+    };
+}
+export function createCommandRoutes() {
+    const router = Router();
+    router.use(authMiddleware);
+    // ponytail: in-memory lock per command-id, cegah race dua POST /start bersamaan
+    // (check-then-spawn). Cek+add sync tanpa await = atomic di event loop. Cukup
+    // untuk single-user; jika multi-instance, ganti dengan mutex per-process / DB unique.
+    const startingCommands = new Set();
+    // List definitions + run state for a project
+    router.get('/projects/:project/commands', (req, res) => {
+        const { project } = req.params;
+        const list = commandsDb
+            .listCommandsWithRunState(project)
+            .map(toWire)
+            .filter((c) => c !== null);
+        res.json(list);
+    });
+    // Create definition
+    router.post('/projects/:project/commands', (req, res) => {
+        const { project } = req.params;
+        if (!projectPath(project)) {
+            return res.status(400).json({ error: 'Project folder not found' });
+        }
+        const { name, command, cwd } = req.body ?? {};
+        if (!name || !command) {
+            return res.status(400).json({ error: 'name and command are required' });
+        }
+        if (cwd !== undefined && cwd !== null && cwd !== '' && !resolveCwd(project, cwd)) {
+            return res.status(400).json({ error: 'cwd must be inside project base path' });
+        }
+        try {
+            const created = commandsDb.createCommand(project, { name, command, cwd: cwd || null });
+            res.status(201).json(toWire(commandsDb.getCommandWithRunState(created.id)));
+        }
+        catch (err) {
+            // SQLITE_CONSTRAINT_UNIQUE = nama duplikat; error lain (mis. tabel hilang)
+            // jangan disamarkan sebagai "already exists" — kasih pesan asli.
+            if (err instanceof Error && /UNIQUE constraint/i.test(err.message)) {
+                res.status(409).json({ error: 'Command name already exists for this project' });
+            }
+            else {
+                console.error('[commands] create failed:', err);
+                res.status(500).json({ error: 'Failed to save command' });
+            }
+        }
+    });
+    // Update definition
+    router.put('/commands/:id', (req, res) => {
+        const id = Number(req.params.id);
+        const cmd = commandsDb.getCommand(id);
+        if (!cmd)
+            return res.status(404).json({ error: 'Command not found' });
+        const { name, command, cwd, position } = req.body ?? {};
+        if (cwd !== undefined && cwd !== null && cwd !== '' && !resolveCwd(cmd.project, cwd)) {
+            return res.status(400).json({ error: 'cwd must be inside project base path' });
+        }
+        try {
+            commandsDb.updateCommand(id, {
+                name,
+                command,
+                cwd: cwd === undefined ? undefined : cwd || null,
+                position,
+            });
+            res.json(toWire(commandsDb.getCommandWithRunState(id)));
+        }
+        catch (err) {
+            if (err instanceof Error && /UNIQUE constraint/i.test(err.message)) {
+                res.status(409).json({ error: 'Command name already exists for this project' });
+            }
+            else {
+                console.error('[commands] update failed:', err);
+                res.status(500).json({ error: 'Failed to save command' });
+            }
+        }
+    });
+    // Delete definition (stop running instance first)
+    router.delete('/commands/:id', async (req, res) => {
+        const id = Number(req.params.id);
+        const cmd = commandsDb.getCommand(id);
+        if (!cmd)
+            return res.status(404).json({ error: 'Command not found' });
+        const session = commandsDb.getSessionByCommandId(id);
+        if (session) {
+            await killCommandSession(session.name);
+            deleteSession(session.name);
+            broadcastSessionRemoved(session.name);
+        }
+        commandsDb.deleteCommand(id);
+        commandsDb.clearCommandId(id);
+        res.json({ success: true });
+    });
+    // Start
+    router.post('/commands/:id/start', async (req, res) => {
+        const id = Number(req.params.id);
+        const cmd = commandsDb.getCommand(id);
+        if (!cmd)
+            return res.status(404).json({ error: 'Command not found' });
+        if (commandsDb.getSessionByCommandId(id)) {
+            return res.status(409).json({ error: 'Already running' });
+        }
+        if (startingCommands.has(id)) {
+            return res.status(409).json({ error: 'Already starting' });
+        }
+        startingCommands.add(id);
+        const cwd = resolveCwd(cmd.project, cmd.cwd);
+        if (!cwd) {
+            startingCommands.delete(id);
+            return res.status(400).json({ error: 'Project folder not found' });
+        }
+        const sessionName = generateCommandSessionName(cmd.project, cmd.name);
+        try {
+            await spawnCommandSession(sessionName, cwd, cmd.command);
+        }
+        catch (err) {
+            console.error(`[commands] spawn failed for ${cmd.project}/${cmd.name}:`, err);
+            startingCommands.delete(id);
+            return res.status(500).json({ error: 'Failed to start command' });
+        }
+        if (!hasCommandSession(sessionName)) {
+            // Command keluar langsung (mis. typo / binary hilang)
+            startingCommands.delete(id);
+            return res.status(500).json({ error: 'Command exited immediately' });
+        }
+        insertCommandSession(sessionName, cmd.project, id);
+        startingCommands.delete(id);
+        await broadcastSessionsList();
+        res.json(toWire(commandsDb.getCommandWithRunState(id)));
+    });
+    // Stop
+    router.post('/commands/:id/stop', async (req, res) => {
+        const id = Number(req.params.id);
+        const session = commandsDb.getSessionByCommandId(id);
+        if (!session)
+            return res.status(404).json({ error: 'Not running' });
+        await killCommandSession(session.name);
+        deleteSession(session.name);
+        broadcastSessionRemoved(session.name);
+        res.json(toWire(commandsDb.getCommandWithRunState(id)));
+    });
+    // Restart = stop (tolerant) + start
+    router.post('/commands/:id/restart', async (req, res) => {
+        const id = Number(req.params.id);
+        const cmd = commandsDb.getCommand(id);
+        if (!cmd)
+            return res.status(404).json({ error: 'Command not found' });
+        const existing = commandsDb.getSessionByCommandId(id);
+        if (existing) {
+            await killCommandSession(existing.name);
+            deleteSession(existing.name);
+            broadcastSessionRemoved(existing.name);
+        }
+        const cwd = resolveCwd(cmd.project, cmd.cwd);
+        if (!cwd)
+            return res.status(400).json({ error: 'Project folder not found' });
+        const sessionName = generateCommandSessionName(cmd.project, cmd.name);
+        try {
+            await spawnCommandSession(sessionName, cwd, cmd.command);
+        }
+        catch (err) {
+            console.error('[commands] restart spawn failed:', err);
+            return res.status(500).json({ error: 'Failed to restart command' });
+        }
+        if (!hasCommandSession(sessionName)) {
+            return res.status(500).json({ error: 'Command exited immediately' });
+        }
+        insertCommandSession(sessionName, cmd.project, id);
+        await broadcastSessionsList();
+        res.json(toWire(commandsDb.getCommandWithRunState(id)));
+    });
+    return router;
+}
+//# sourceMappingURL=commands.js.map

package/agent/dist/routes/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/routes/commands.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAOvD,SAAS,eAAe;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,OAAe,EAAE,WAA2B;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CACb,GAAyD;IAEzD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,QAAQ,GAA2B;QACvC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW;QACrC,MAAM,EAAG,GAAG,CAAC,QAAQ,CAAC,MAA+B,IAAI,IAAI;QAC7D,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY;KACxC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3B,gFAAgF;IAChF,6EAA6E;IAC7E,sFAAsF;IACtF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,6CAA6C;IAC7C,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC/B,MAAM,IAAI,GAAG,UAAU;aACpB,wBAAwB,CAAC,OAAO,CAAC;aACjC,GAAG,CAAC,MAAM,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAmC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACjF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,iEAAiE;YACjE,IAAI,GAAG,YAAY,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACtE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACxD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACrF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC;YACH,UAAU,CAAC,aAAa,CAAC,EAAE,EAAE;gBAC3B,IAAI;gBACJ,OAAO;gBACP,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI;gBAChD,QAAQ;aACT,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC7B,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,QAAQ;IACR,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAEtE,IAAI,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,CAAC;YACzC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEzB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9E,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,sDAAsD;YACtD,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,oBAAoB,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnD,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,qBAAqB,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,OAAO;IACP,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAEpE,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAG,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAE7E,MAAM,WAAW,GAAG,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,oBAAoB,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,qBAAqB,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/agent/dist/routes/files.d.ts

@@ -0,0 +1,7 @@
+/**
+ * File explorer API: read-only listing direktori + baca isi file per project.
+ * Path-traversal guard reuse pola routes/commands.ts. Tidak ada write/delete.
+ */
+import { Router } from 'express';
+export declare function createFileRoutes(): Router;
+//# sourceMappingURL=files.d.ts.map

package/agent/dist/routes/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/routes/files.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AA2FjC,wBAAgB,gBAAgB,IAAI,MAAM,CA4GzC"}

package/agent/dist/routes/files.js

@@ -0,0 +1,206 @@
+/**
+ * File explorer API: read-only listing direktori + baca isi file per project.
+ * Path-traversal guard reuse pola routes/commands.ts. Tidak ada write/delete.
+ */
+import { Router } from 'express';
+import * as path from 'path';
+import * as fs from 'fs/promises';
+import { config } from '../config.js';
+import { authMiddleware } from '../middleware/auth.js';
+const MAX_TEXT_BYTES = 1024 * 1024; // 1 MB
+const MAX_IMAGE_BYTES = 1024 * 1024; // 1 MB
+// ponytail: skip daftar folder berat/tidak relevan di listing MVP. Toggle nanti.
+const SKIP_DIRS = new Set(['.git', 'node_modules']);
+const MIME_MAP = {
+    '.ts': 'text/typescript',
+    '.tsx': 'text/typescript',
+    '.js': 'text/javascript',
+    '.jsx': 'text/javascript',
+    '.mjs': 'text/javascript',
+    '.cjs': 'text/javascript',
+    '.json': 'application/json',
+    '.md': 'text/markdown',
+    '.markdown': 'text/markdown',
+    '.css': 'text/css',
+    '.scss': 'text/css',
+    '.html': 'text/html',
+    '.htm': 'text/html',
+    '.xml': 'text/xml',
+    '.yml': 'text/yaml',
+    '.yaml': 'text/yaml',
+    '.toml': 'text/toml',
+    '.ini': 'text/plain',
+    '.env': 'text/plain',
+    '.sh': 'text/x-shellscript',
+    '.bash': 'text/x-shellscript',
+    '.py': 'text/x-python',
+    '.go': 'text/x-go',
+    '.rs': 'text/x-rust',
+    '.java': 'text/x-java',
+    '.php': 'text/x-php',
+    '.rb': 'text/x-ruby',
+    '.sql': 'text/x-sql',
+    '.txt': 'text/plain',
+    '.log': 'text/plain',
+    '.csv': 'text/csv',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.svg': 'image/svg+xml',
+};
+const IMAGE_MIMES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/svg+xml']);
+function resolveBasePath() {
+    return config.projects.basePath.replace('~', process.env.HOME || '~');
+}
+/** Path absolut folder project; null jika di luar basePath (path traversal). */
+function projectPath(project) {
+    const basePath = resolveBasePath();
+    const full = path.join(basePath, project);
+    const rel = path.relative(basePath, full);
+    if (rel.startsWith('..') || path.isAbsolute(rel))
+        return null;
+    return full;
+}
+/** Resolve relPath di dalam project root; null jika keluar (path traversal). */
+function resolveInsideProject(project, relPath) {
+    const root = projectPath(project);
+    if (!root)
+        return null;
+    const clean = relPath.replace(/^\/+/, ''); // trim leading slash
+    if (path.isAbsolute(clean))
+        return null;
+    const full = path.join(root, clean);
+    const rel = path.relative(root, full);
+    if (rel.startsWith('..') || path.isAbsolute(rel))
+        return null;
+    return full;
+}
+function mimeTypeFor(name) {
+    const ext = path.extname(name).toLowerCase();
+    return MIME_MAP[ext] ?? 'application/octet-stream';
+}
+/** Deteksi apakah file biner adalah text dengan cek utf8 round-trip (no dep). */
+function looksLikeText(buf) {
+    if (buf.length === 0)
+        return true;
+    const str = buf.toString('utf8');
+    return Buffer.byteLength(str, 'utf8') === buf.length && !buf.includes(0x00);
+}
+export function createFileRoutes() {
+    const router = Router();
+    router.use(authMiddleware);
+    // List direktori (file + dir + symlink), skip SKIP_DIRS.
+    router.get('/projects/:project/files', async (req, res) => {
+        const project = req.params.project;
+        const rawPath = typeof req.query.path === 'string' ? req.query.path : '';
+        const dirPath = resolveInsideProject(project, path.normalize(rawPath));
+        if (!dirPath)
+            return res.status(400).json({ error: 'Invalid path' });
+        try {
+            const entries = await fs.readdir(dirPath, { withFileTypes: true });
+            const mapped = [];
+            for (const entry of entries) {
+                if (entry.isDirectory() && SKIP_DIRS.has(entry.name))
+                    continue;
+                if (entry.isSymbolicLink())
+                    mapped.push({ name: entry.name, type: 'symlink' });
+                else if (entry.isDirectory())
+                    mapped.push({ name: entry.name, type: 'dir' });
+                else if (entry.isFile())
+                    mapped.push({ name: entry.name, type: 'file' });
+            }
+            mapped.sort((a, b) => {
+                if (a.type === 'dir' && b.type !== 'dir')
+                    return -1;
+                if (a.type !== 'dir' && b.type === 'dir')
+                    return 1;
+                return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
+            });
+            const response = { path: rawPath, entries: mapped };
+            res.json(response);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                return res.status(404).json({ error: 'Path not found' });
+            }
+            console.error('files list error:', err);
+            res.status(500).json({ error: 'Failed to list directory' });
+        }
+    });
+    // Baca isi file: text (utf8, truncate 1MB) atau image (base64).
+    router.get('/projects/:project/file', async (req, res) => {
+        const project = req.params.project;
+        const rawPath = typeof req.query.path === 'string' ? req.query.path : '';
+        const fullPath = resolveInsideProject(project, path.normalize(rawPath));
+        if (!fullPath)
+            return res.status(400).json({ error: 'Invalid path' });
+        try {
+            // ponytail: lstat no-follow; symlink tidak di-resolve (cegah escape basePath).
+            const lstat = await fs.lstat(fullPath);
+            if (lstat.isSymbolicLink())
+                return res.status(400).json({ error: 'Symlink not followed' });
+            if (!lstat.isFile())
+                return res.status(400).json({ error: 'Not a file' });
+            const stat = await fs.stat(fullPath);
+            const name = path.basename(fullPath);
+            const mimeType = mimeTypeFor(name);
+            const size = stat.size;
+            if (IMAGE_MIMES.has(mimeType)) {
+                if (size > MAX_IMAGE_BYTES)
+                    return res.status(413).json({ error: 'File too large' });
+                const buf = await fs.readFile(fullPath);
+                const response = {
+                    path: rawPath,
+                    name,
+                    mimeType,
+                    size,
+                    encoding: 'base64',
+                    content: buf.toString('base64'),
+                };
+                return res.json(response);
+            }
+            // Text: baca sampai MAX_TEXT_BYTES, flag truncated jika lebih.
+            const handle = await fs.open(fullPath, 'r');
+            try {
+                const buf = Buffer.alloc(Math.min(size, MAX_TEXT_BYTES));
+                const { bytesRead } = await handle.read(buf, 0, buf.length, 0);
+                const data = buf.subarray(0, bytesRead);
+                if (!looksLikeText(data)) {
+                    return res.json({
+                        path: rawPath,
+                        name,
+                        mimeType: 'application/octet-stream',
+                        size,
+                        encoding: 'base64',
+                        content: '',
+                    });
+                }
+                const truncated = size > MAX_TEXT_BYTES;
+                const response = {
+                    path: rawPath,
+                    name,
+                    mimeType,
+                    size,
+                    encoding: 'text',
+                    content: data.toString('utf8'),
+                    ...(truncated ? { truncated: true } : {}),
+                };
+                res.json(response);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                return res.status(404).json({ error: 'File not found' });
+            }
+            console.error('file read error:', err);
+            res.status(500).json({ error: 'Failed to read file' });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=files.js.map

package/agent/dist/routes/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/routes/files.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAC3C,MAAM,eAAe,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAC5C,iFAAiF;AACjF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpD,MAAM,QAAQ,GAA2B;IACvC,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,eAAe;IAC5B,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,WAAW;IACpB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,oBAAoB;IAC3B,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,aAAa;IACpB,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;AAErG,SAAS,eAAe;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,OAAe,EAAE,OAAe;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE3B,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,MAAM,GAAe,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/D,IAAI,KAAK,CAAC,cAAc,EAAE;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;qBAC1E,IAAI,KAAK,CAAC,WAAW,EAAE;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;qBACxE,IAAI,KAAK,CAAC,MAAM,EAAE;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACnB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,CAAC,CAAC,CAAC;gBACpD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,CAAC,CAAC;gBACnD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC;YACH,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAE1E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAEvB,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,IAAI,IAAI,GAAG,eAAe;oBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAwB;oBACpC,IAAI,EAAE,OAAO;oBACb,IAAI;oBACJ,QAAQ;oBACR,IAAI;oBACJ,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAChC,CAAC;gBACF,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAED,+DAA+D;YAC/D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;gBACzD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACxC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,GAAG,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO;wBACb,IAAI;wBACJ,QAAQ,EAAE,0BAA0B;wBACpC,IAAI;wBACJ,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,EAAE;qBACkB,CAAC,CAAC;gBACnC,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,GAAG,cAAc,CAAC;gBACxC,MAAM,QAAQ,GAAwB;oBACpC,IAAI,EAAE,OAAO;oBACb,IAAI;oBACJ,QAAQ;oBACR,IAAI;oBACJ,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC9B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/agent/dist/routes/hooks.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Hook API routes for Claude Code / Codex hook notifications.
+ * Receives status updates from hook scripts and broadcasts to WebSocket subscribers.
+ */
+import { Router } from 'express';
+export declare function createHooksRoutes(): Router;
+//# sourceMappingURL=hooks.d.ts.map

package/agent/dist/routes/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/routes/hooks.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAsEjC,wBAAgB,iBAAiB,IAAI,MAAM,CAyG1C"}