@agent-native/core 0.85.6 → 0.86.0

package/corpus/templates/design/actions/write-local-file.ts

@@ -8,8 +8,14 @@
  *     must exist. The agent CANNOT bypass this check.
  *  4. Path confinement: assertPathInside ensures the target stays inside
  *     rootPath (pre-bridge check; bridge also validates with realpath).
- *  5. Bridge token: the X-Bridge-Token header is set to the per-grant token
- *     minted at consent time so the bridge can reject unauthorized calls.
+ *  5. Bridge token: the X-Bridge-Token header is set to the connection's
+ *     CURRENT bridge token (falling back to the token snapshotted on the
+ *     grant). The CLI mints a fresh token on every bridge start, so a bridge
+ *     restart + reconnect rotates the connection token while the user's
+ *     time-boxed consent grant stays valid; preferring the connection token
+ *     keeps writes working across restarts. A bridge 401/403 is surfaced as a
+ *     specific stale-token error telling the user to re-run design connect
+ *     and re-grant write consent.
  */
 
 import path from "node:path";
@@ -23,15 +29,66 @@ import { z } from "zod";
 import { getDb, schema } from "../server/db/index.js";
 import { verifyWriteGrant } from "../server/lib/verify-write-grant.js";
 
-/** File extensions the agent is permitted to write via the bridge. */
-const ALLOWED_EXTENSIONS = new Set([".html", ".htm", ".css"]);
+/**
+ * Text/code file extensions the agent is permitted to write via the bridge.
+ * Mirrors ALLOWED_WRITE_EXTENSIONS in the core design-connect bridge, which
+ * enforces the same list plus a secret-path blocklist on its side.
+ */
+const ALLOWED_EXTENSIONS = new Set([
+  ".html",
+  ".htm",
+  ".css",
+  ".scss",
+  ".less",
+  ".js",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".mjs",
+  ".cjs",
+  ".json",
+  ".md",
+  ".mdx",
+  ".vue",
+  ".svelte",
+  ".astro",
+  ".txt",
+  ".yml",
+  ".yaml",
+  ".svg",
+]);
+
+/**
+ * Secret-looking paths are never writable, regardless of extension. All
+ * comparisons are case-insensitive: macOS's default filesystem (and Windows)
+ * is case-insensitive, so ".ENV", "ID_RSA", or "KEY.PEM" refer to the exact
+ * same on-disk file as their lowercase form and must be blocked identically.
+ * Mirrors isBlockedSecretPath in packages/core/src/cli/design-connect.ts.
+ */
+function isBlockedSecretPath(relPath: string): boolean {
+  const segments = relPath
+    .split(/[\\/]+/)
+    .filter(Boolean)
+    .map((segment) => segment.toLowerCase());
+  const basename = segments[segments.length - 1] ?? "";
+  if (segments.some((segment) => segment === ".git")) return true;
+  if (basename.startsWith(".env")) return true;
+  if (basename.endsWith(".pem") || basename.endsWith(".key")) return true;
+  if (basename.startsWith("id_rsa")) return true;
+  return false;
+}
 
 function assertAllowedExtension(relPath: string): void {
+  if (isBlockedSecretPath(relPath)) {
+    throw new Error(
+      `File "${relPath}" looks like a secret or VCS-internal file and may not be written through the bridge.`,
+    );
+  }
   const ext = path.extname(relPath).toLowerCase();
   if (!ALLOWED_EXTENSIONS.has(ext)) {
     throw new Error(
       `File "${relPath}" has extension "${ext}" which is not allowed. ` +
-        "Only .html, .htm, and .css files may be written through the bridge.",
+        "Only text and code files (HTML, CSS, JS/TS, JSON, Markdown, and similar) may be written through the bridge.",
     );
   }
 }
@@ -53,6 +110,30 @@ function isLoopbackHostname(hostname: string): boolean {
   );
 }
 
+/**
+ * Build the error for a failed bridge call. 401/403 means the bridge rejected
+ * the token — after a bridge restart the CLI mints a fresh token, so a token
+ * snapshotted at consent time goes stale even though the grant itself is
+ * still valid. Surface that as a specific, actionable message instead of a
+ * generic failure.
+ */
+function bridgeRequestError(
+  operation: string,
+  status: number,
+  errText: string,
+): Error {
+  if (status === 401 || status === 403) {
+    return new Error(
+      `Bridge ${operation} rejected authentication (${status}). ` +
+        "The stored bridge token is stale — the design bridge was likely restarted " +
+        "since write consent was granted (each bridge start mints a fresh token). " +
+        "Re-run `npx @agent-native/core@latest design connect` and re-grant write " +
+        "consent, then retry.",
+    );
+  }
+  return new Error(`Bridge ${operation} failed (${status}): ${errText}`);
+}
+
 function normalizeBridgeUrl(value: string): string {
   const parsed = new URL(value.trim());
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
@@ -75,11 +156,14 @@ function normalizeBridgeUrl(value: string): string {
 
 export default defineAction({
   description:
-    "Write or patch a local file (HTML or CSS only) via the localhost design bridge. " +
-    "The user MUST have already granted write consent via grant-localhost-write-consent; " +
-    "this action will reject the request if no valid grant exists. " +
-    "Pass content for a full file write, or {search, replace} for a targeted patch. " +
-    "Requires editor access on the design.",
+    "Write or patch a local file via the localhost design bridge. Accepts " +
+    "common text/code files: HTML, CSS, JS/TS/JSX/TSX, JSON, Markdown, YAML, " +
+    "SVG, Vue/Svelte/Astro, and similar. Secret-looking paths (.env*, *.pem, " +
+    "*.key, id_rsa*, anything under .git/) are always blocked, regardless of " +
+    "extension. The user MUST have already granted write consent via " +
+    "grant-localhost-write-consent; this action will reject the request if no " +
+    "valid grant exists. Pass content for a full file write, or {search, " +
+    "replace} for a targeted patch. Requires editor access on the design.",
   schema: z.object({
     designId: z.string().describe("Design ID."),
     connectionId: z
@@ -88,8 +172,10 @@ export default defineAction({
     relPath: z
       .string()
       .describe(
-        "Path to the file relative to the connection rootPath. " +
-          "Only .html, .htm, and .css files are accepted.",
+        "Path to the file relative to the connection rootPath. Common " +
+          "text/code files are accepted (HTML, CSS, JS/TS/JSX/TSX, JSON, " +
+          "Markdown, YAML, SVG, Vue/Svelte/Astro, and similar); " +
+          "secret-looking paths are always rejected.",
       ),
     content: z
       .string()
@@ -109,8 +195,24 @@ export default defineAction({
         "Search-and-replace patch. Use for targeted edits. " +
           "Mutually exclusive with content.",
       ),
+    expectedVersionHash: z
+      .string()
+      .optional()
+      .describe(
+        "Optional version hash previously returned by read-local-file or a " +
+          "prior write. When provided, the bridge rejects the write with a " +
+          "version-conflict error if the file changed on disk since that " +
+          "hash was read.",
+      ),
   }),
-  run: async ({ designId, connectionId, relPath, content, patch }) => {
+  run: async ({
+    designId,
+    connectionId,
+    relPath,
+    content,
+    patch,
+    expectedVersionHash,
+  }) => {
     // --- Gate 1: access ---
     await assertAccess("design", designId, "editor");
 
@@ -140,10 +242,13 @@ export default defineAction({
       );
     }
 
-    // --- Resolve bridge URL ---
+    // --- Resolve bridge URL + current token ---
     const db = getDb();
     const [connection] = await db
-      .select({ bridgeUrl: schema.designLocalhostConnections.bridgeUrl })
+      .select({
+        bridgeUrl: schema.designLocalhostConnections.bridgeUrl,
+        bridgeToken: schema.designLocalhostConnections.bridgeToken,
+      })
       .from(schema.designLocalhostConnections)
       .where(
         and(
@@ -160,10 +265,15 @@ export default defineAction({
       );
     }
 
+    // Prefer the connection's CURRENT bridge token over the one snapshotted on
+    // the grant: the CLI mints a fresh token on every bridge start, and a
+    // later connect-localhost by the same authenticated user refreshes the
+    // connection row. The user's time-boxed consent grant is unchanged — only
+    // the transport token rotated — so writes keep working across restarts.
     const bridgeUrl = normalizeBridgeUrl(connection.bridgeUrl);
     const headers: Record<string, string> = {
       "Content-Type": "application/json",
-      "X-Bridge-Token": grant.bridgeToken,
+      "X-Bridge-Token": connection.bridgeToken || grant.bridgeToken,
     };
 
     if (content !== undefined) {
@@ -171,27 +281,30 @@ export default defineAction({
       const res = await fetch(`${bridgeUrl}/write-file`, {
         method: "POST",
         headers,
-        body: JSON.stringify({ relPath, content }),
+        body: JSON.stringify({ relPath, content, expectedVersionHash }),
       });
       if (!res.ok) {
+        if (res.status === 409) {
+          throw new Error(
+            `version conflict: "${relPath}" changed on disk since it was last read.`,
+          );
+        }
         const errText = await res.text().catch(() => res.statusText);
-        throw new Error(`Bridge write-file failed (${res.status}): ${errText}`);
+        throw bridgeRequestError("write-file", res.status, errText);
       }
-      return { designId, relPath, operation: "write" as const, written: true };
+      const body = (await res.json().catch(() => ({}))) as {
+        versionHash?: string;
+      };
+      return {
+        designId,
+        relPath,
+        operation: "write" as const,
+        written: true,
+        versionHash: body.versionHash,
+      };
     } else {
-      // Search-and-replace patch — first read, then apply-edit
-      const readRes = await fetch(`${bridgeUrl}/read-file`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({ relPath }),
-      });
-      if (!readRes.ok) {
-        const errText = await readRes.text().catch(() => readRes.statusText);
-        throw new Error(
-          `Bridge read-file failed (${readRes.status}): ${errText}`,
-        );
-      }
-
+      // Search-and-replace patch. The bridge's /apply-edit validates the file
+      // itself (404s on a missing file), so no pre-read round-trip is needed.
       const applyRes = await fetch(`${bridgeUrl}/apply-edit`, {
         method: "POST",
         headers,
@@ -199,15 +312,28 @@ export default defineAction({
           relPath,
           search: patch!.search,
           replace: patch!.replace,
+          expectedVersionHash,
         }),
       });
       if (!applyRes.ok) {
+        if (applyRes.status === 409) {
+          throw new Error(
+            `version conflict: "${relPath}" changed on disk since it was last read.`,
+          );
+        }
         const errText = await applyRes.text().catch(() => applyRes.statusText);
-        throw new Error(
-          `Bridge apply-edit failed (${applyRes.status}): ${errText}`,
-        );
+        throw bridgeRequestError("apply-edit", applyRes.status, errText);
       }
-      return { designId, relPath, operation: "patch" as const, written: true };
+      const body = (await applyRes.json().catch(() => ({}))) as {
+        versionHash?: string;
+      };
+      return {
+        designId,
+        relPath,
+        operation: "patch" as const,
+        written: true,
+        versionHash: body.versionHash,
+      };
     }
   },
 });

package/corpus/templates/design/app/components/design/CanvasContextMenu.tsx

@@ -139,6 +139,13 @@ export interface CanvasContextMenuProps {
   canReorder?: boolean;
   canGroup?: boolean;
   canUngroup?: boolean;
+  // L12: this menu is target-agnostic — it has no built-in notion of "design
+  // title" vs "layer". Rename is enabled by default for a single selection
+  // (see the canRename default below) and fires through the onRename
+  // callback / onAction("rename", ...) regardless of what's selected. Any
+  // "only rename the design title" restriction is a CALL-SITE decision (e.g.
+  // passing canRename={false} and/or hiddenActions={["rename"]} when a layer
+  // is selected instead of the design title) — it does not live here.
   canRename?: boolean;
   canToggleLocked?: boolean;
   canToggleHidden?: boolean;
@@ -173,6 +180,11 @@ export interface CanvasContextMenuProps {
   onSendToBack?: CanvasContextMenuActionHandler;
   onGroup?: CanvasContextMenuActionHandler;
   onUngroup?: CanvasContextMenuActionHandler;
+  // L12: fired when the Rename item is selected (details.selectedCount tells
+  // the caller how many things are selected). The caller decides what
+  // "rename" means for the current target — e.g. calling a LayersPanel
+  // ref's beginRename(layerId) when exactly one layer is selected, vs.
+  // starting design-title rename when nothing is selected.
   onRename?: CanvasContextMenuActionHandler;
   onToggleLocked?: CanvasContextMenuActionHandler;
   onToggleHidden?: CanvasContextMenuActionHandler;