@axiom-lattice/gateway 3.0.2 → 3.0.4

package/src/controllers/workspace.ts

@@ -1,879 +0,0 @@
-/**
- * WorkspaceController
- *
- * Controller for workspace and project management
- * Handles CRUD operations, file browsing, and file uploads
- */
-
-import { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
-import * as fs from "fs/promises";
-import * as path from "path";
-import { constants as fsConstants } from "fs";
-import * as os from "os";
-import { getStoreLattice } from "@axiom-lattice/core";
-import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
-import { getSandBoxManager } from "@axiom-lattice/core";
-import { v4 as uuidv4 } from "uuid";
-import { getContentTypeFromFilename, getFilenameFromPath } from "../utils/mime";
-import {
-  isPathWithinRoot,
-  PathOutsideRootError,
-  resolvePathWithinRoot,
-} from "../utils/path-containment";
-import type {
-  CreateWorkspaceRequest,
-  UpdateWorkspaceRequest,
-  CreateProjectRequest,
-  UpdateProjectRequest,
-  Workspace,
-  Project,
-} from "@axiom-lattice/protocols";
-
-interface WorkspaceParams {
-  workspaceId: string;
-}
-
-interface ProjectParams {
-  workspaceId: string;
-  projectId: string;
-}
-
-interface ListPathQuery {
-  path?: string;
-  assistantId?: string;
-}
-
-interface ReadFileQuery {
-  path: string;
-  offset?: number;
-  limit?: number;
-  assistantId?: string;
-}
-
-export class WorkspaceController {
-  private workspaceStore;
-  private projectStore;
-
-  constructor() {
-    this.workspaceStore = getStoreLattice("default", "workspace").store;
-    this.projectStore = getStoreLattice("default", "project").store;
-  }
-
-  private getTenantId(request: FastifyRequest): string {
-    // First try to get from authenticated user context
-    const userTenantId = (request as any).user?.tenantId;
-    if (userTenantId) {
-      return userTenantId;
-    }
-
-    // Try to get from query parameters (for direct URL access like file downloads)
-    const queryTenantId = (request.query as any)?.tenantId;
-    if (queryTenantId) {
-      return String(queryTenantId);
-    }
-
-    // Fallback to request headers for backward compatibility
-    return (request.headers["x-tenant-id"] as string) || "default";
-  }
-
-  // ==================== Workspace CRUD ====================
-
-  async listWorkspaces(request: FastifyRequest, reply: FastifyReply) {
-    const tenantId = this.getTenantId(request);
-    const workspaces = await this.workspaceStore.getAllWorkspaces(tenantId);
-    return { success: true, data: workspaces };
-  }
-
-  async createWorkspace(
-    request: FastifyRequest<{ Body: CreateWorkspaceRequest }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const data = request.body;
-    const id = uuidv4();
-
-    const workspace = await this.workspaceStore.createWorkspace(
-      tenantId,
-      id,
-      data
-    );
-
-    return reply.status(201).send({ success: true, data: workspace });
-  }
-
-  async getWorkspace(
-    request: FastifyRequest<{ Params: WorkspaceParams }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId } = request.params;
-
-    const workspace = await this.workspaceStore.getWorkspaceById(
-      tenantId,
-      workspaceId
-    );
-
-    if (!workspace) {
-      return reply.status(404).send({ success: false, error: "Workspace not found" });
-    }
-
-    return { success: true, data: workspace };
-  }
-
-  async updateWorkspace(
-    request: FastifyRequest<{
-      Params: WorkspaceParams;
-      Body: UpdateWorkspaceRequest;
-    }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId } = request.params;
-    const updates = request.body;
-
-    const workspace = await this.workspaceStore.updateWorkspace(
-      tenantId,
-      workspaceId,
-      updates
-    );
-
-    if (!workspace) {
-      return reply.status(404).send({ success: false, error: "Workspace not found" });
-    }
-
-    return { success: true, data: workspace };
-  }
-
-  async deleteWorkspace(
-    request: FastifyRequest<{ Params: WorkspaceParams }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId } = request.params;
-
-    const deleted = await this.workspaceStore.deleteWorkspace(
-      tenantId,
-      workspaceId
-    );
-
-    if (!deleted) {
-      return reply.status(404).send({ success: false, error: "Workspace not found" });
-    }
-
-    return { success: true };
-  }
-
-  // ==================== Project CRUD ====================
-
-  async listProjects(
-    request: FastifyRequest<{ Params: WorkspaceParams }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId } = request.params;
-
-    const projects = await this.projectStore.getProjectsByWorkspace(
-      tenantId,
-      workspaceId
-    );
-
-    return { success: true, data: projects };
-  }
-
-  async createProject(
-    request: FastifyRequest<{
-      Params: WorkspaceParams;
-      Body: CreateProjectRequest;
-    }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId } = request.params;
-    const data = request.body;
-    const id = uuidv4();
-
-    const project = await this.projectStore.createProject(
-      tenantId,
-      workspaceId,
-      id,
-      data
-    );
-
-    return reply.status(201).send({ success: true, data: project });
-  }
-
-  async getProject(
-    request: FastifyRequest<{ Params: ProjectParams }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { projectId } = request.params;
-
-    const project = await this.projectStore.getProjectById(tenantId, projectId);
-
-    if (!project) {
-      return reply.status(404).send({ success: false, error: "Project not found" });
-    }
-
-    return { success: true, data: project };
-  }
-
-  async updateProject(
-    request: FastifyRequest<{
-      Params: ProjectParams;
-      Body: UpdateProjectRequest;
-    }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { projectId } = request.params;
-    const updates = request.body;
-
-    const project = await this.projectStore.updateProject(
-      tenantId,
-      projectId,
-      updates
-    );
-
-    if (!project) {
-      return reply.status(404).send({ success: false, error: "Project not found" });
-    }
-
-    return { success: true, data: project };
-  }
-
-  async deleteProject(
-    request: FastifyRequest<{ Params: ProjectParams }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { projectId } = request.params;
-
-    const deleted = await this.projectStore.deleteProject(tenantId, projectId);
-
-    if (!deleted) {
-      return reply.status(404).send({ success: false, error: "Project not found" });
-    }
-
-    return { success: true };
-  }
-
-  // ==================== File Operations ====================
-
-  private async getBackend(tenantId: string, workspaceId: string, projectId: string, assistantId?: string, filePath?: string) {
-    const workspace = await this.workspaceStore.getWorkspaceById(
-      tenantId,
-      workspaceId
-    );
-
-    if (!workspace) {
-      throw new Error("Workspace not found");
-    }
-
-    console.log(`[getBackend] storageType=${workspace.storageType} filePath=${filePath}`);
-
-    if (workspace.storageType === "sandbox") {
-      const sandboxManager = getSandBoxManager();
-
-      const volumeConfig = {
-        assistant_id: assistantId || "",
-        thread_id: "",
-        tenantId,
-        workspaceId,
-        projectId,
-      };
-
-      console.log(`[getBackend] trying volume backend for path=${filePath} assistant_id=${assistantId}`);
-      const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, filePath || "/project");
-      if (volumeBackend) {
-        console.log(`[getBackend] using VolumeFilesystem`);
-        return { backend: volumeBackend, workspace };
-      }
-
-      console.log(`[getBackend] volume not found, falling back to SandboxFilesystem`);
-      const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
-      console.log(`[getBackend] sandbox acquired, name=${(sandbox as any).name || "unknown"}`);
-      return {
-        backend: new SandboxFilesystem({
-          sandboxInstance: sandbox,
-        }), workspace
-      };
-    }
-
-    // Filesystem storage: use default /lattice_store path
-    const rootDir = await this.getFilesystemRootDirectory(
-      tenantId,
-      workspaceId,
-      projectId,
-    );
-
-    console.log(`[getBackend] using FilesystemBackend rootDir=${rootDir}`);
-    return {
-      backend: new FilesystemBackend({
-        rootDir,
-        virtualMode: true,
-      }), workspace
-    };
-  }
-
-  private async getFilesystemRootDirectory(
-    tenantId: string,
-    workspaceId: string,
-    projectId: string,
-  ): Promise<string> {
-    return `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`;
-  }
-
-  private isBinaryContentType(filename: string): boolean {
-    const ext = filename.split(".").pop()?.toLowerCase() || "";
-    const binaryExtensions = new Set([
-      "pdf", "xlsx", "xls", "docx", "doc", "pptx", "ppt",
-      "png", "jpg", "jpeg", "gif", "bmp", "ico", "webp",
-      "mp3", "mp4", "webm", "ogg", "wav", "avi", "mov",
-      "zip", "tar", "gz", "rar", "7z",
-    ]);
-    return binaryExtensions.has(ext);
-  }
-
-  async downloadFile(
-    request: FastifyRequest<{
-      Params: ProjectParams;
-      Querystring: { path: string; assistantId?: string };
-    }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId, projectId } = request.params;
-    const filePath = request.query.path;
-    const assistantId = request.query.assistantId;
-
-    if (!filePath) {
-      return reply.status(400).send({ success: false, error: "Path is required" });
-    }
-
-    try {
-      const { workspace } = await this.getBackend(tenantId, workspaceId, projectId, assistantId);
-      const resolvedPath = filePath;
-
-      if (workspace.storageType === "sandbox") {
-        const sandboxManager = getSandBoxManager();
-        const volumeConfig = {
-          assistant_id: assistantId || "",
-          thread_id: "",
-          tenantId,
-          workspaceId,
-          projectId,
-        };
-
-        const filename = getFilenameFromPath(resolvedPath);
-        const isBinary = this.isBinaryContentType(filename);
-
-        // Use volume backend when available; fall back to sandbox
-        const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
-
-        let buf: Buffer;
-        if (volumeBackend) {
-          if (isBinary && volumeBackend.readBinary) {
-            buf = await volumeBackend.readBinary(resolvedPath);
-          } else {
-            const fileData = await volumeBackend.readRaw(resolvedPath);
-            buf = Buffer.from(fileData.content.join("\n"), "utf-8");
-          }
-        } else {
-          const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
-          buf = await sandbox.file.downloadFile({ file: resolvedPath });
-        }
-
-        const inferredContentType = getContentTypeFromFilename(filename);
-
-        const contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`;
-        return reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
-      }
-
-      const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
-      const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = getFilenameFromPath(resolvedPath);
-      const mimeType = getContentTypeFromFilename(filename);
-      const buffer = Buffer.from(content, "utf-8");
-
-      return reply
-        .status(200)
-        .type(mimeType)
-        .header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`)
-        .send(buffer);
-    } catch (error: unknown) {
-      const message = error instanceof Error ? error.message : String(error);
-      return reply.status(502).send({ success: false, error: `Download proxy error: ${message}` });
-    }
-  }
-
-  /**
-   * View a file inline in the browser (not download).
-   * Returns file content with inline Content-Disposition for preview.
-   */
-  async viewFile(
-    request: FastifyRequest<{
-      Params: ProjectParams;
-      Querystring: { path: string; assistantId?: string };
-    }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId, projectId } = request.params;
-    const filePath = request.query.path;
-    const assistantId = request.query.assistantId;
-
-    if (!filePath) {
-      return reply.status(400).send({ success: false, error: "Path is required" });
-    }
-
-    try {
-      const { workspace } = await this.getBackend(tenantId, workspaceId, projectId, assistantId);
-      const resolvedPath = filePath;
-
-      if (workspace.storageType === "sandbox") {
-        const sandboxManager = getSandBoxManager();
-        const volumeConfig = {
-          assistant_id: assistantId || "",
-          thread_id: "",
-          tenantId,
-          workspaceId,
-          projectId,
-        };
-
-        const filename = getFilenameFromPath(resolvedPath);
-        const isBinary = this.isBinaryContentType(filename);
-
-        // Use volume backend when available; fall back to sandbox
-        const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
-
-        let buf: Buffer;
-        if (volumeBackend) {
-          if (isBinary && volumeBackend.readBinary) {
-            buf = await volumeBackend.readBinary(resolvedPath);
-          } else {
-            const fileData = await volumeBackend.readRaw(resolvedPath);
-            buf = Buffer.from(fileData.content.join("\n"), "utf-8");
-          }
-        } else {
-          const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
-          buf = await sandbox.file.downloadFile({ file: resolvedPath });
-        }
-
-        const inferredContentType = getContentTypeFromFilename(filename);
-
-        try {
-          const contentType = inferredContentType;
-
-          // Inject AI2APP context script for HTML files (sandbox storage)
-          const isHtml = contentType?.toLowerCase().includes("text/html") || 
-                         filename.toLowerCase().endsWith(".html") || 
-                         filename.toLowerCase().endsWith(".htm");
-          let outputBuf = buf;
-          if (isHtml) {
-            console.log(`[viewFile] Injecting AI2APP context for sandbox HTML file: ${filename}, tenantId: ${tenantId}, contentType: ${contentType}`);
-            let content = buf.toString("utf-8");
-            const contextScript = `<script>window.__AI2APP_CONTEXT__=${JSON.stringify({
-              tenantId,
-              workspaceId,
-              projectId,
-              timestamp: Date.now()
-            })};</script>`;
-            
-            if (content.toLowerCase().includes("</head>")) {
-              content = content.replace(/<\/head>/i, `${contextScript}</head>`);
-              console.log(`[viewFile] Context script injected before </head>`);
-            } else if (content.toLowerCase().includes("<html>")) {
-              content = content.replace(/<html>/i, `<html>${contextScript}`);
-              console.log(`[viewFile] Context script injected after <html>`);
-            } else {
-              content = contextScript + content;
-              console.log(`[viewFile] Context script prepended to content`);
-            }
-            outputBuf = Buffer.from(content, "utf-8");
-          }
-
-          return reply
-            .status(200)
-            .type(contentType)
-            .header("Content-Disposition", "inline")
-            .send(outputBuf);
-        } catch (err) {
-          return reply.status(502).send({ success: false, error: String(err) });
-        }
-      }
-
-      const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
-      const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = getFilenameFromPath(resolvedPath);
-      const mimeType = getContentTypeFromFilename(filename);
-
-      // Inject AI2APP context script for HTML files
-      let finalContent = content;
-      const isHtmlFs = mimeType?.toLowerCase().includes("text/html") || 
-                       filename.toLowerCase().endsWith(".html") || 
-                       filename.toLowerCase().endsWith(".htm");
-      if (isHtmlFs) {
-        console.log(`[viewFile] Injecting AI2APP context for filesystem HTML file: ${filename}, tenantId: ${tenantId}, mimeType: ${mimeType}`);
-        const contextScript = `<script>window.__AI2APP_CONTEXT__=${JSON.stringify({
-          tenantId,
-          workspaceId,
-          projectId,
-          timestamp: Date.now()
-        })};</script>`;
-        // Insert before </head> or </html>
-        if (content.toLowerCase().includes("</head>")) {
-          finalContent = content.replace(/<\/head>/i, `${contextScript}</head>`);
-          console.log(`[viewFile] Context script injected before </head>`);
-        } else if (content.toLowerCase().includes("</html>")) {
-          finalContent = content.replace(/<\/html>/i, `${contextScript}</html>`);
-          console.log(`[viewFile] Context script injected before </html>`);
-        } else {
-          finalContent = content + contextScript;
-          console.log(`[viewFile] Context script appended to content`);
-        }
-      }
-
-      const buffer = Buffer.from(finalContent, "utf-8");
-
-      return reply
-        .status(200)
-        .type(mimeType)
-        .header("Content-Disposition", "inline")
-        .send(buffer);
-    } catch (error: unknown) {
-      const message = error instanceof Error ? error.message : String(error);
-      return reply.status(502).send({ success: false, error: `View proxy error: ${message}` });
-    }
-  }
-
-  async listPath(
-    request: FastifyRequest<{
-      Params: ProjectParams;
-      Querystring: ListPathQuery;
-    }>
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId, projectId } = request.params;
-    const path = (request.query.path as string) || "/";
-    const assistantId = request.query.assistantId;
-
-    console.log(`[listPath] tenantId=${tenantId} workspaceId=${workspaceId} projectId=${projectId} path=${path} assistantId=${assistantId}`);
-
-    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path);
-    console.log(`[listPath] backend type=${backend.constructor.name} calling lsInfo(${path})`);
-
-    const files = await backend.lsInfo(path);
-    console.log(`[listPath] result count=${files.length}`);
-
-    return { success: true, data: files };
-  }
-
-  async readFile(
-    request: FastifyRequest<{
-      Params: ProjectParams;
-      Querystring: ReadFileQuery;
-    }>
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId, projectId } = request.params;
-    const { path, offset = 0, limit = 1000, assistantId } = request.query;
-
-    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path);
-    const content = await backend.read(path, Number(offset), Number(limit));
-
-    return { success: true, data: { content, offset, limit } };
-  }
-
-  /**
-   * Upload a file to the workspace project storage.
-   *
-   * Route: POST /api/workspaces/:workspaceId/projects/:projectId/uploadfile
-   * Accepts multipart/form-data with:
-   * - `file`: the file to upload (required)
-   * - `path`: optional directory path relative to project root (e.g., "docs", "src/utils")
-   * - `assistantId`: optional query parameter for sandbox identity matching
-   * For sandbox storage, delegates to the sandbox upload API.
-   * For filesystem storage, writes under the same project root used by the file backend.
-   */
-  async uploadFile(
-    request: FastifyRequest<{
-      Params: ProjectParams;
-      Querystring: { assistantId?: string };
-    }>,
-    reply: FastifyReply
-  ) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId, projectId } = request.params;
-    const assistantId = (request.query as any).assistantId || (request.headers["x-assistant-id"] as string);
-
-    const workspace = await this.workspaceStore.getWorkspaceById(
-      tenantId,
-      workspaceId
-    );
-
-    if (!workspace) {
-      return reply
-        .status(404)
-        .send({ success: false, error: "Workspace not found" });
-    }
-
-    try {
-      const data = await (request as any).file();
-      if (!data) {
-        return reply
-          .status(400)
-          .send({ success: false, error: "No file in request" });
-      }
-
-      const buffer: Buffer = await data.toBuffer();
-      const filename: string = data.filename || "file";
-
-      const pathEntry = data.fields?.path;
-      const pathValue =
-        pathEntry && typeof pathEntry === "object" && "value" in pathEntry
-          ? String((pathEntry as { value: unknown }).value)
-          : typeof pathEntry === "string"
-            ? pathEntry
-            : undefined;
-
-      if (pathValue && !/^[a-zA-Z0-9_./~-]+$/.test(pathValue)) {
-        return reply
-          .status(400)
-          .send({ success: false, error: "Invalid path parameter" });
-      }
-
-      if (workspace.storageType === "sandbox") {
-        const sandboxManager = getSandBoxManager();
-        const volumeConfig = {
-          assistant_id: assistantId || "",
-          thread_id: "",
-          tenantId,
-          workspaceId,
-          projectId,
-        };
-
-        const realPath = pathValue
-          ? path.posix.join(pathValue, filename)
-          : path.posix.join("/project/uploads", filename);
-
-        const isBinary = this.isBinaryContentType(filename);
-        const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, realPath);
-        if (volumeBackend && !isBinary) {
-          await volumeBackend.write(realPath, buffer.toString("utf-8"));
-        } else if (volumeBackend && volumeBackend.writeBinary) {
-          await volumeBackend.writeBinary(realPath, buffer);
-        } else {
-          const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
-          await sandbox.file.uploadFile({ file: realPath, data: buffer });
-        }
-
-        const relativePath = pathValue
-          ? path.posix.join(pathValue, filename)
-          : path.posix.join("/project/uploads", filename);
-
-        const result = {
-          path: relativePath,
-          name: filename,
-          is_dir: false,
-          size: buffer.length,
-          modified_at: new Date().toISOString(),
-        };
-
-        return reply.status(200).send({ success: true, data: result });
-      }
-
-      const rootDir = await this.getFilesystemRootDirectory(
-        tenantId,
-        workspaceId,
-        projectId,
-      );
-      await fs.mkdir(rootDir, { recursive: true });
-      const relativeDirectory = pathValue?.replace(/^[/\\]+/, "") || ".";
-      const targetDir = path.resolve(rootDir, relativeDirectory);
-      if (!isPathWithinRoot(path.resolve(rootDir), targetDir)) {
-        return reply.status(400).send({
-          success: false,
-          error: "Upload path must stay within the project directory",
-        });
-      }
-      await fs.mkdir(targetDir, { recursive: true });
-
-      const [resolvedRoot, resolvedTargetDir] = await Promise.all([
-        fs.realpath(rootDir),
-        fs.realpath(targetDir),
-      ]);
-      if (!isPathWithinRoot(resolvedRoot, resolvedTargetDir)) {
-        return reply.status(400).send({
-          success: false,
-          error: "Upload path must stay within the project directory",
-        });
-      }
-
-      const safeFilename = path.basename(filename);
-      if (safeFilename !== filename) {
-        return reply.status(400).send({
-          success: false,
-          error: "Invalid filename",
-        });
-      }
-      const targetPath = path.join(resolvedTargetDir, safeFilename);
-      await fs.writeFile(targetPath, buffer);
-      const stat = await fs.stat(targetPath);
-
-      const result = {
-        path: path.posix.join("/", relativeDirectory, safeFilename),
-        name: filename,
-        is_dir: false,
-        size: stat.size,
-        modified_at: stat.mtime.toISOString(),
-      };
-
-      return reply.status(200).send({ success: true, data: result });
-    } catch (error: unknown) {
-      const message = error instanceof Error ? error.message : String(error);
-      return reply.status(500).send({
-        success: false,
-        error: `Upload handler error: ${message}`,
-      });
-    }
-  }
-  /**
-   * Browse local filesystem directories for the folder picker.
-   *
-   * Security constraints:
-   * - Restricted to os.homedir()
-   * - Blacklists system directories
-   * - Returns only directory names, no file contents or hidden files
-   */
-  async browseFilesystem(
-    request: FastifyRequest<{
-      Querystring: { path?: string };
-    }>,
-    reply: FastifyReply
-  ) {
-    const homeDir = os.homedir();
-    const requestedPath = request.query.path || homeDir;
-
-    const SYSTEM_BLACKLIST = ["/etc", "/sys", "/proc", "/var", "/tmp", "/dev"];
-
-    try {
-      const resolved = await resolvePathWithinRoot(homeDir, requestedPath);
-      const normalized = resolved.targetPath;
-
-      for (const blacklisted of SYSTEM_BLACKLIST) {
-        if (isPathWithinRoot(blacklisted, normalized)) {
-          return reply.status(403).send({
-            success: false,
-            error: `Cannot browse system directory: ${blacklisted}`,
-          });
-        }
-      }
-
-      const entries = await fs.readdir(normalized, { withFileTypes: true });
-      const dirEntries = entries
-        .filter((entry) => !entry.name.startsWith(".") && entry.isDirectory())
-        .map((entry) => ({
-          name: entry.name,
-          path: path.join(normalized, entry.name),
-          isDirectory: true,
-        }));
-
-      const parentPath = path.dirname(normalized);
-      const hasParent =
-        parentPath !== normalized &&
-        isPathWithinRoot(resolved.rootPath, parentPath);
-
-      return {
-        success: true,
-        data: {
-          path: normalized,
-          parentPath: hasParent ? parentPath : undefined,
-          entries: dirEntries,
-        },
-      };
-    } catch (error: unknown) {
-      if (error instanceof PathOutsideRootError) {
-        return reply.status(403).send({
-          success: false,
-          error: "Browse restricted to home directory",
-        });
-      }
-      const message = error instanceof Error ? error.message : String(error);
-      return reply.status(400).send({
-        success: false,
-        error: `Cannot read directory: ${message}`,
-      });
-    }
-  }
-}
-
-export function registerWorkspaceRoutes(app: FastifyInstance) {
-  const controller = new WorkspaceController();
-
-  // Workspace routes
-  app.get("/api/workspaces", controller.listWorkspaces.bind(controller));
-  app.post("/api/workspaces", controller.createWorkspace.bind(controller));
-  app.get(
-    "/api/workspaces/:workspaceId",
-    controller.getWorkspace.bind(controller)
-  );
-  app.patch(
-    "/api/workspaces/:workspaceId",
-    controller.updateWorkspace.bind(controller)
-  );
-  app.delete(
-    "/api/workspaces/:workspaceId",
-    controller.deleteWorkspace.bind(controller)
-  );
-
-  // Project routes
-  app.get(
-    "/api/workspaces/:workspaceId/projects",
-    controller.listProjects.bind(controller)
-  );
-  app.post(
-    "/api/workspaces/:workspaceId/projects",
-    controller.createProject.bind(controller)
-  );
-  app.get(
-    "/api/workspaces/:workspaceId/projects/:projectId",
-    controller.getProject.bind(controller)
-  );
-  app.patch(
-    "/api/workspaces/:workspaceId/projects/:projectId",
-    controller.updateProject.bind(controller)
-  );
-  app.delete(
-    "/api/workspaces/:workspaceId/projects/:projectId",
-    controller.deleteProject.bind(controller)
-  );
-
-  // File operations
-  app.get(
-    "/api/workspaces/:workspaceId/projects/:projectId/listpath",
-    controller.listPath.bind(controller)
-  );
-  app.get(
-    "/api/workspaces/:workspaceId/projects/:projectId/readfile",
-    controller.readFile.bind(controller)
-  );
-  app.post(
-    "/api/workspaces/:workspaceId/projects/:projectId/uploadfile",
-    controller.uploadFile.bind(controller)
-  );
-  app.get(
-    "/api/workspaces/:workspaceId/projects/:projectId/downloadfile",
-    controller.downloadFile.bind(controller)
-  );
-  app.get(
-    "/api/workspaces/:workspaceId/projects/:projectId/viewfile",
-    controller.viewFile.bind(controller)
-  );
-
-  // Filesystem browsing for folder picker
-  app.get(
-    "/api/filesystem/browse",
-    controller.browseFilesystem.bind(controller)
-  );
-}