@ayushporwal/coja 0.0.1

package/dist/projects/add.js

@@ -0,0 +1,111 @@
+import { mkdir, rm, stat } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { cloneBare, isBareRepo, isGitRepo, remoteUrl, topLevel } from '../git/plumbing.js';
+import { parseGitHubRemote, parseRepoSlug } from '../git/remote.js';
+import { GitError } from '../git/run.js';
+import { badRequest, HttpError, notFound } from '../routes/http.js';
+import { deleteProject, findProjectByPath, getProject, insertProject } from './store.js';
+/**
+ * Adding and removing projects (design.md, "Projects → PR list"): a `local`
+ * project is the user's own clone, identified through its `origin` remote; a
+ * `clone` project is a bare clone coja manages under `<dataDir>/repos/`.
+ */
+/** Register the git repository at `inputPath` (absolute, or `~`-relative) as a local project. */
+export async function addLocalProject(ctx, inputPath) {
+    const resolved = resolveUserPath(inputPath);
+    let info;
+    try {
+        info = await stat(resolved);
+    }
+    catch {
+        throw badRequest(`${resolved} does not exist`);
+    }
+    if (!info.isDirectory())
+        throw badRequest(`${resolved} is not a directory`);
+    if (!(await isGitRepo(resolved)))
+        throw badRequest(`${resolved} is not a git repository`);
+    // Normalise to the working-tree root so the same clone is never registered twice.
+    const repoPath = (await isBareRepo(resolved))
+        ? resolved
+        : ((await topLevel(resolved)) ?? resolved);
+    const existing = findProjectByPath(ctx.db, repoPath);
+    if (existing)
+        return existing;
+    const url = await remoteUrl(repoPath, 'origin');
+    if (!url) {
+        throw badRequest(`${repoPath} has no "origin" remote; coja needs a GitHub remote to find its pull requests`);
+    }
+    const gh = parseGitHubRemote(url);
+    if (!gh)
+        throw badRequest(`the "origin" remote of ${repoPath} is not a GitHub repository (${url})`);
+    return insertProject(ctx.db, { kind: 'local', owner: gh.owner, repo: gh.repo, path: repoPath });
+}
+/** Clone `owner/repo` (or a github.com URL) bare into the data dir and register it. */
+export async function addCloneProject(ctx, slug, opts = {}) {
+    const parsed = parseRepoSlug(slug);
+    if (!parsed) {
+        throw badRequest(`"${slug}" is not a GitHub repository (expected owner/repo or a github.com URL)`);
+    }
+    const { owner, repo } = parsed;
+    const dir = cloneDir(ctx.dataDir, owner, repo);
+    const existing = findProjectByPath(ctx.db, dir);
+    if (existing)
+        return existing;
+    if (await isGitRepo(dir)) {
+        // Only a bare clone of ours is adopted; anything else at that path is not ours to use.
+        if (!(await isBareRepo(dir))) {
+            throw badRequest(`${dir} already exists but is not a bare repository; move it away and try again`);
+        }
+    }
+    else {
+        await mkdir(path.dirname(dir), { recursive: true });
+        // A leftover from an interrupted clone would make `git clone` refuse the directory.
+        await rm(dir, { recursive: true, force: true });
+        try {
+            await (opts.clone ?? cloneBare)(`https://github.com/${owner}/${repo}.git`, dir, {
+                signal: opts.signal,
+            });
+        }
+        catch (err) {
+            // Whether git failed or the request was aborted, never leave a half-written clone behind.
+            await rm(dir, { recursive: true, force: true });
+            if (err instanceof GitError) {
+                const detail = err.stderr.trim() || err.message;
+                throw new HttpError(400, `could not clone ${owner}/${repo}: ${detail}`, 'git');
+            }
+            throw err;
+        }
+    }
+    return insertProject(ctx.db, { kind: 'clone', owner, repo, path: dir });
+}
+/**
+ * Forget a project. App-managed bare clones are deleted from disk (they are
+ * ours); a local project's files are never touched.
+ */
+export async function removeProject(ctx, id) {
+    const project = getProject(ctx.db, id);
+    if (!project)
+        throw notFound('project');
+    deleteProject(ctx.db, id);
+    if (project.kind === 'clone' && isInside(reposDir(ctx.dataDir), project.path)) {
+        await rm(project.path, { recursive: true, force: true });
+    }
+}
+export const reposDir = (dataDir) => path.join(dataDir, 'repos');
+/** `<dataDir>/repos/<owner>__<repo>.git`, lower-cased because GitHub slugs are case-insensitive. */
+export function cloneDir(dataDir, owner, repo) {
+    return path.join(reposDir(dataDir), `${owner}__${repo}.git`.toLowerCase());
+}
+function resolveUserPath(input) {
+    const trimmed = input.trim();
+    if (trimmed === '~')
+        return os.homedir();
+    if (trimmed.startsWith('~/'))
+        return path.resolve(os.homedir(), trimmed.slice(2));
+    return path.resolve(trimmed);
+}
+function isInside(parent, child) {
+    const rel = path.relative(parent, child);
+    return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
+}

package/dist/projects/store.js

@@ -0,0 +1,37 @@
+import { randomBytes } from 'node:crypto';
+import { nowIso } from '../db.js';
+const toProject = (r) => ({
+    id: r.id,
+    kind: r.kind,
+    owner: r.owner,
+    repo: r.repo,
+    path: r.path,
+    createdAt: r.created_at,
+});
+export function listProjects(db) {
+    const rows = db
+        .prepare('SELECT * FROM projects ORDER BY created_at ASC')
+        .all();
+    return rows.map(toProject);
+}
+export function getProject(db, id) {
+    const row = db.prepare('SELECT * FROM projects WHERE id = ?').get(id);
+    return row ? toProject(row) : undefined;
+}
+export function findProjectByPath(db, path) {
+    const row = db.prepare('SELECT * FROM projects WHERE path = ?').get(path);
+    return row ? toProject(row) : undefined;
+}
+export function insertProject(db, input) {
+    const project = {
+        id: randomBytes(6).toString('hex'),
+        ...input,
+        createdAt: nowIso(),
+    };
+    db.prepare('INSERT INTO projects (id, kind, owner, repo, path, created_at) VALUES (?, ?, ?, ?, ?, ?)').run(project.id, project.kind, project.owner, project.repo, project.path, project.createdAt);
+    return project;
+}
+export function deleteProject(db, id) {
+    const res = db.prepare('DELETE FROM projects WHERE id = ?').run(id);
+    return Number(res.changes) > 0;
+}

package/dist/routes/chat.js

@@ -0,0 +1,187 @@
+import { z } from 'zod';
+import { handleChatTurn } from '../ai/chat-handler.js';
+import { createChat, deleteChat, getChat, listChats } from '../ai/chats.js';
+import { buildSystemPrompt } from '../ai/prompt.js';
+import { defaultModelId, parseModelId, } from '../ai/providers.js';
+import { describeTools } from '../ai/tools.js';
+import { diffNameStatus } from '../git/plumbing.js';
+import { badRequest, HttpError, notFound } from './http.js';
+import { PR_ROUTE, resolvePr } from './pulls.js';
+/**
+ * AI chat routes (API_ROUTES.prChats / prChat / prChatMessages / prAiContext).
+ *
+ * Deliberate shape: this module gets a read-only `readPullRequest` function,
+ * never a Forge, so nothing reachable from the AI layer can post to GitHub —
+ * "the AI drafts, the human sends". Routes that read PR code (a chat turn,
+ * the ai-context preview) answer 409 until the PR's objects are fetched, like
+ * the git routes; chat bookkeeping (list/create/get/delete) needs no objects.
+ */
+export const CHATS_ROUTE = `${PR_ROUTE}/chats`;
+export const CHAT_ROUTE = `${CHATS_ROUTE}/:chatId`;
+export const CHAT_MESSAGES_ROUTE = `${CHAT_ROUTE}/messages`;
+export const AI_CONTEXT_ROUTE = `${PR_ROUTE}/ai-context`;
+const newChatSchema = z.object({ model: z.string().min(1).optional() });
+/**
+ * The browser re-sends the whole conversation every turn, so one request is
+ * bounded here (bytes, messages); what of it reaches the model is bounded in
+ * ai/history.ts.
+ */
+export const MAX_BODY_BYTES = 5 * 1024 * 1024;
+export const MAX_MESSAGES = 400;
+const chatRequestSchema = z.object({
+    messages: z
+        .array(z.unknown())
+        .max(MAX_MESSAGES, `a conversation may hold at most ${MAX_MESSAGES} messages; start a new chat`),
+    model: z.string().min(1),
+    reasoningEffort: z.string().min(1).max(32).optional(),
+});
+export function registerChatRoutes(app, ctx, deps) {
+    const { secrets, fetcher, readPullRequest } = deps;
+    /** Head and merge base once the PR's objects are in the repository; 409 (`code: 'git'`) before. */
+    const requireReady = (project, number) => {
+        const status = fetcher.status(project.id, number);
+        if (status.state === 'ready' && status.headOid && status.mergeBaseOid) {
+            return { headOid: status.headOid, mergeBaseOid: status.mergeBaseOid };
+        }
+        throw new HttpError(409, 'PR objects are still being fetched', 'git');
+    };
+    /** The PR detail and its changed files from git — the AI's standing context. */
+    const loadPr = async (project, number) => {
+        const { headOid, mergeBaseOid } = requireReady(project, number);
+        const [detail, files] = await Promise.all([
+            readPullRequest(project, number),
+            diffNameStatus(project.path, mergeBaseOid, headOid),
+        ]);
+        return { headOid, mergeBaseOid, detail, files };
+    };
+    /** The chat named by `:chatId`, which must belong to this project and PR. */
+    const loadChat = (c, project, number) => {
+        const id = c.req.param('chatId') ?? '';
+        const found = id ? getChat(ctx.db, id) : undefined;
+        if (!found || found.chat.projectId !== project.id || found.chat.prNumber !== number) {
+            throw notFound('chat');
+        }
+        return found;
+    };
+    app.get(CHATS_ROUTE, (c) => {
+        const { project, number } = resolvePr(ctx, c);
+        return c.json(listChats(ctx.db, project.id, number));
+    });
+    app.post(CHATS_ROUTE, async (c) => {
+        const { project, number } = resolvePr(ctx, c);
+        const body = parse(newChatSchema, await readJsonBody(c));
+        const model = body.model ?? (await defaultModelId(deps.subscription));
+        if (!model)
+            throw new HttpError(400, 'No AI provider configured', 'provider');
+        parseModelId(model, deps.customProviders);
+        return c.json(createChat(ctx.db, { projectId: project.id, prNumber: number, model }), 201);
+    });
+    app.get(CHAT_ROUTE, (c) => {
+        const { project, number } = resolvePr(ctx, c);
+        return c.json(loadChat(c, project, number));
+    });
+    app.delete(CHAT_ROUTE, (c) => {
+        const { project, number } = resolvePr(ctx, c);
+        const { chat } = loadChat(c, project, number);
+        deleteChat(ctx.db, chat.id);
+        return c.json({ ok: true });
+    });
+    app.post(CHAT_MESSAGES_ROUTE, async (c) => {
+        const { project, number } = resolvePr(ctx, c);
+        const { chat } = loadChat(c, project, number);
+        const body = parse(chatRequestSchema, await readJsonBody(c));
+        // An unknown model is a 400 here, before the fetch-state check and whichever model resolver runs.
+        const { provider, modelId } = parseModelId(body.model);
+        // A requested reasoning effort must be one the backend catalog offers for
+        // this model (subscription path); other providers do not take one from coja.
+        if (body.reasoningEffort && provider === 'chatgpt') {
+            const ok = deps.subscription &&
+                (await deps.subscription
+                    .supportsReasoningEffort(modelId, body.reasoningEffort)
+                    .catch(() => false));
+            if (!ok) {
+                throw new HttpError(400, `reasoning effort "${body.reasoningEffort}" is not offered for ${modelId}; pick one from the model's list`, 'provider');
+            }
+        }
+        const { headOid, mergeBaseOid, detail, files } = await loadPr(project, number);
+        return handleChatTurn({
+            db: ctx.db,
+            secrets,
+            chat,
+            messages: body.messages,
+            model: body.model,
+            toolContext: {
+                repo: project.path,
+                headOid,
+                baseOid: mergeBaseOid,
+                files,
+            },
+            detail,
+            files,
+            signal: c.req.raw.signal,
+            customProviders: deps.customProviders,
+            ...(body.reasoningEffort ? { reasoningEffort: body.reasoningEffort } : {}),
+            ...(deps.subscription ? { subscription: deps.subscription } : {}),
+            ...(deps.resolveModel ? { languageModel: await deps.resolveModel(body.model, secrets) } : {}),
+        });
+    });
+    app.get(AI_CONTEXT_ROUTE, async (c) => {
+        const { project, number } = resolvePr(ctx, c);
+        const { detail, files } = await loadPr(project, number);
+        const response = {
+            system: buildSystemPrompt({ detail, files }),
+            tools: describeTools(),
+        };
+        return c.json(response);
+    });
+}
+/** The JSON body, or `{}` when there is none (all fields of NewChatRequest are optional). 413 past MAX_BODY_BYTES. */
+async function readJsonBody(c) {
+    const text = await readBodyText(c, MAX_BODY_BYTES);
+    if (text.trim() === '')
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw badRequest('request body must be JSON');
+    }
+}
+/**
+ * The request body as text, refusing more than `maxBytes` with a 413: up front
+ * when Content-Length says so, otherwise as soon as the stream exceeds the cap,
+ * so an oversized body is never buffered whole (let alone parsed).
+ */
+async function readBodyText(c, maxBytes) {
+    const tooLarge = () => new HttpError(413, `request body too large: at most ${maxBytes / (1024 * 1024)} MB per chat request`, 'bad_request');
+    const declared = Number(c.req.header('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes)
+        throw tooLarge();
+    const body = c.req.raw.body;
+    if (!body)
+        return '';
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel().catch(() => undefined);
+            throw tooLarge();
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+function parse(schema, value) {
+    const result = schema.safeParse(value);
+    if (result.success)
+        return result.data;
+    const issues = result.error.issues
+        .map((i) => (i.path.length ? `${i.path.map(String).join('.')}: ${i.message}` : i.message))
+        .join('; ');
+    throw badRequest(`invalid request: ${issues}`);
+}

package/dist/routes/fs.js

@@ -0,0 +1,65 @@
+import { readdir, stat } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { API_ROUTES } from '../shared/api.js';
+import { badRequest, notFound } from './http.js';
+/**
+ * Read-only filesystem browsing for the Add-project path picker (design.md §2).
+ * Names of subdirectories only — never file listings, contents, or a disk-wide
+ * search — capped and prefix-filtered so a huge directory costs the same as a
+ * small one. The request guard already confines the app to loopback; this adds
+ * no capability a local user lacks, and the picker only ever *suggests* paths
+ * (adding one still validates that it is a git clone with an origin remote).
+ */
+/** Hard ceiling for one listing; the picker asks for no more than this. */
+export const FS_LIST_CAP = 500;
+export function registerFsRoutes(app) {
+    app.get(API_ROUTES.fsHome, (c) => c.json({ home: os.homedir() }));
+    app.get(API_ROUTES.fsDirs, async (c) => {
+        const raw = c.req.query('path') ?? '';
+        if (!raw.startsWith('/'))
+            throw badRequest('path must be an absolute path');
+        const prefix = (c.req.query('prefix') ?? '').toLowerCase();
+        const parsedLimit = Number.parseInt(c.req.query('limit') ?? '', 10);
+        const limit = Number.isFinite(parsedLimit)
+            ? Math.min(Math.max(parsedLimit, 1), FS_LIST_CAP)
+            : FS_LIST_CAP;
+        let entries;
+        try {
+            entries = await readdir(raw, { withFileTypes: true, encoding: 'utf8' });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'ENOENT')
+                throw notFound(`directory ${raw}`);
+            if (code === 'ENOTDIR')
+                throw badRequest(`${raw} is not a directory`);
+            if (code === 'EACCES')
+                throw badRequest(`${raw} is not readable`);
+            throw err;
+        }
+        const names = entries
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => entry.name)
+            .sort((a, b) => a.localeCompare(b, undefined, { sensitivity: 'base', numeric: true }))
+            .filter((name) => (prefix ? name.toLowerCase().startsWith(prefix) : true));
+        const slice = names.slice(0, limit);
+        // One stat per listed entry, capped: a `.git` entry (directory, file for
+        // worktrees/submodules) marks a likely clone worth a badge in the picker.
+        const dirs = await Promise.all(slice.map(async (name) => {
+            const hasGit = await stat(path.join(raw, name, '.git'))
+                .then(() => true)
+                .catch(() => false);
+            return { name, hasGit };
+        }));
+        const parent = path.dirname(raw);
+        const body = {
+            path: raw,
+            parent: parent === raw ? null : parent,
+            dirs,
+            total: names.length,
+            truncated: names.length > slice.length,
+        };
+        return c.json(body);
+    });
+}

package/dist/routes/git.js

@@ -0,0 +1,75 @@
+import { z } from 'zod';
+import { getBlob, getChangedFiles, getFileDiff } from '../pr/objects.js';
+import { getProject } from '../projects/store.js';
+import { badRequest, HttpError, notFound } from './http.js';
+import { validate } from './projects.js';
+const PR = '/api/projects/:projectId/prs/:number';
+const DiffQuery = z.object({
+    path: z.string().min(1),
+    previousPath: z.string().min(1).optional(),
+});
+const BlobQuery = z.object({
+    ref: z.enum(['base', 'head']).default('head'),
+    path: z.string().min(1),
+    start: z.coerce.number().int().min(1).optional(),
+    end: z.coerce.number().int().min(1).optional(),
+});
+/**
+ * `API_ROUTES.prFetch`, `prGitFiles`, `prDiff`, `prBlob`: the git side of a
+ * pull request. Everything but `fetch` answers 409 (`code: 'git'`) until the
+ * PR's objects are fetched; the UI polls `GET …/fetch` meanwhile.
+ */
+export function registerGitRoutes(app, ctx, deps) {
+    const { forge, fetcher } = deps;
+    const load = (c) => {
+        const project = getProject(ctx.db, c.req.param('projectId') ?? '');
+        if (!project)
+            throw notFound('project');
+        return { project, number: parsePrNumber(c.req.param('number')) };
+    };
+    const requireReady = (project, number) => {
+        const status = fetcher.status(project.id, number);
+        if (status.state === 'ready' && status.headOid && status.baseOid && status.mergeBaseOid) {
+            return { headOid: status.headOid, baseOid: status.baseOid, mergeBaseOid: status.mergeBaseOid };
+        }
+        const reason = status.state === 'error'
+            ? `fetching PR #${number} failed: ${status.error ?? 'unknown error'}`
+            : `PR #${number} is not fetched yet (${status.state}); POST …/fetch first`;
+        throw new HttpError(409, reason, 'git');
+    };
+    app.post(`${PR}/fetch`, async (c) => {
+        const { project, number } = load(c);
+        const refs = await forge.getPullRequestRefs({ owner: project.owner, repo: project.repo }, number);
+        return c.json(await fetcher.ensure(project, refs));
+    });
+    app.get(`${PR}/fetch`, (c) => {
+        const { project, number } = load(c);
+        return c.json(fetcher.status(project.id, number));
+    });
+    app.get(`${PR}/git-files`, async (c) => {
+        const { project, number } = load(c);
+        const { mergeBaseOid, headOid } = requireReady(project, number);
+        return c.json(await getChangedFiles(project.path, mergeBaseOid, headOid));
+    });
+    app.get(`${PR}/diff`, async (c) => {
+        const { project, number } = load(c);
+        const query = validate(DiffQuery, c.req.query());
+        const { mergeBaseOid, headOid } = requireReady(project, number);
+        return c.json(await getFileDiff(project.path, mergeBaseOid, headOid, query.path, query.previousPath));
+    });
+    app.get(`${PR}/blob`, async (c) => {
+        const { project, number } = load(c);
+        const query = validate(BlobQuery, c.req.query());
+        const ready = requireReady(project, number);
+        // `base` is the merge base: the commit the diff's left side shows.
+        const oid = query.ref === 'head' ? ready.headOid : ready.mergeBaseOid;
+        return c.json(await getBlob(project.path, query.ref, oid, query.path, query.start, query.end));
+    });
+}
+function parsePrNumber(raw) {
+    const n = Number(raw);
+    if (raw === undefined || !/^\d+$/.test(raw) || !Number.isSafeInteger(n) || n <= 0) {
+        throw badRequest(`invalid pull request number: ${raw ?? ''}`);
+    }
+    return n;
+}

package/dist/routes/guard.js

@@ -0,0 +1,96 @@
+const LOOPBACK_HOSTNAMES = ['127.0.0.1', 'localhost', '::1'];
+/** Methods that never mutate here; the UI only ever reads through them. */
+const SAFE_METHODS = new Set(['GET', 'HEAD']);
+/** `app.use(requestGuard())` — see {@link registerRequestGuard}. */
+export function requestGuard(opts = {}) {
+    const allowed = new Set([
+        ...LOOPBACK_HOSTNAMES,
+        ...(opts.allowedHosts ?? []).map((h) => h.trim().toLowerCase()),
+    ]);
+    return async (c, next) => {
+        // The Node adapter builds the request URL from the Host header, so the URL's host is the
+        // same thing; it is the fallback when a request has no Host header (tests, HTTP/1.0).
+        const host = c.req.header('host') ?? new URL(c.req.url).host;
+        const hostname = hostnameOf(host);
+        if (hostname === null || !allowed.has(hostname)) {
+            // Name the offender: someone who reached this over `--host` sees at once which Host was refused.
+            return forbidden(c, `bad host "${host.slice(0, 200)}": only loopback or the --host address is served`);
+        }
+        const method = c.req.method.toUpperCase();
+        // No CORS is offered, so a preflight can only be a cross-origin page probing us.
+        if (method === 'OPTIONS')
+            return forbidden(c, 'cross-site request refused');
+        if (SAFE_METHODS.has(method))
+            return next();
+        const site = c.req.header('sec-fetch-site')?.trim().toLowerCase();
+        if (site !== undefined) {
+            // `same-site` is not enough: another local server on a different port is same-site.
+            if (site !== 'same-origin' && site !== 'none') {
+                return forbidden(c, 'cross-site request refused');
+            }
+        }
+        else {
+            const origin = c.req.header('origin');
+            if (origin !== undefined && !originMatchesHost(origin, host)) {
+                return forbidden(c, 'cross-site request refused');
+            }
+        }
+        if (hasBody(c) && !isJson(c.req.header('content-type'))) {
+            return c.json({ error: 'content-type must be application/json' }, 415);
+        }
+        return next();
+    };
+}
+/** Install the guard on `app` before any route, so it runs for every request. */
+export function registerRequestGuard(app, opts = {}) {
+    app.use('*', requestGuard(opts));
+}
+/**
+ * Hostname of a `Host` header value, lower-cased and without port or IPv6
+ * brackets: `127.0.0.1:4321` → `127.0.0.1`, `[::1]:4321` → `::1`,
+ * `LocalHost` → `localhost`. Null when the value is not a valid host.
+ */
+export function hostnameOf(host) {
+    const value = host.trim().toLowerCase();
+    if (value === '')
+        return null;
+    if (value.startsWith('[')) {
+        const end = value.indexOf(']');
+        if (end === -1)
+            return null;
+        const port = value.slice(end + 1);
+        if (port !== '' && !/^:\d{1,5}$/.test(port))
+            return null;
+        return value.slice(1, end) || null;
+    }
+    const parts = value.split(':');
+    if (parts.length > 2)
+        return null; // an IPv6 literal must be bracketed
+    const [name, port] = parts;
+    if (!name || (port !== undefined && !/^\d{1,5}$/.test(port)))
+        return null;
+    return name;
+}
+/** True when `origin` (an `Origin` header) names the same host and port as `host` (a `Host` header). */
+function originMatchesHost(origin, host) {
+    try {
+        // Parsing both normalises case and default ports (`localhost:80` ≡ `localhost` over http).
+        return new URL(origin).host === new URL(`http://${host}`).host;
+    }
+    catch {
+        return false; // `Origin: null`, or malformed
+    }
+}
+/** A request carries a body iff it declares one (RFC 9112 §6): Content-Length or Transfer-Encoding. */
+function hasBody(c) {
+    const length = c.req.header('content-length');
+    if (length !== undefined)
+        return length.trim() !== '0';
+    return c.req.header('transfer-encoding') !== undefined;
+}
+function isJson(contentType) {
+    return contentType?.split(';')[0]?.trim().toLowerCase() === 'application/json';
+}
+function forbidden(c, error) {
+    return c.json({ error }, 403);
+}

package/dist/routes/http.js

@@ -0,0 +1,35 @@
+import { ForgeError } from '../forge/forge.js';
+/** Error with an HTTP status, raised by route handlers and domain code. */
+export class HttpError extends Error {
+    status;
+    code;
+    constructor(status, message, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'HttpError';
+    }
+}
+export const notFound = (what) => new HttpError(404, `${what} not found`, 'not_found');
+export const badRequest = (message) => new HttpError(400, message, 'bad_request');
+/** Serialize any thrown value as an ApiError response. Register with `app.onError(onApiError)`. */
+export function onApiError(err, c) {
+    if (err instanceof HttpError) {
+        return c.json({ error: err.message, ...(err.code ? { code: err.code } : {}) }, err.status);
+    }
+    if (err instanceof ForgeError) {
+        const status = (err.status >= 400 && err.status <= 599 ? err.status : 502);
+        return c.json({ error: err.message, code: 'github' }, status);
+    }
+    const anyErr = err;
+    if (anyErr?.name === 'ZodError') {
+        return c.json({ error: `invalid request: ${anyErr.message}`, code: 'bad_request' }, 400);
+    }
+    if (anyErr?.name === 'GitError') {
+        return c.json({ error: anyErr.message ?? 'git failed', code: 'git' }, 500);
+    }
+    // Anything else is a bug or an environment failure: log the full error for the operator,
+    // but never echo its message (paths, stack fragments) to the client.
+    console.error(err);
+    return c.json({ error: 'internal error' }, 500);
+}

package/dist/routes/projects.js

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+import { addCloneProject, addLocalProject, removeProject } from '../projects/add.js';
+import { getProject, listProjects } from '../projects/store.js';
+import { badRequest, notFound } from './http.js';
+/** Mirrors `AddProjectRequest` in shared/api.ts. */
+const AddProjectSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('local'), path: z.string().trim().min(1) }),
+    z.object({ kind: z.literal('clone'), slug: z.string().trim().min(1) }),
+]);
+/**
+ * `API_ROUTES.projects` and `API_ROUTES.project`. Register before any `/api/*`
+ * catch-all; errors are thrown and mapped by `onApiError`.
+ */
+export function registerProjectRoutes(app, ctx) {
+    app.get('/api/projects', (c) => c.json(listProjects(ctx.db)));
+    app.post('/api/projects', async (c) => {
+        const body = validate(AddProjectSchema, await readJson(c));
+        const project = body.kind === 'local'
+            ? await addLocalProject(ctx, body.path)
+            : await addCloneProject(ctx, body.slug, { signal: c.req.raw.signal });
+        return c.json(project);
+    });
+    app.get('/api/projects/:projectId', (c) => {
+        const project = getProject(ctx.db, c.req.param('projectId'));
+        if (!project)
+            throw notFound('project');
+        return c.json(project);
+    });
+    app.delete('/api/projects/:projectId', async (c) => {
+        await removeProject(ctx, c.req.param('projectId'));
+        return c.json({ ok: true });
+    });
+}
+async function readJson(c) {
+    try {
+        return await c.req.json();
+    }
+    catch {
+        throw badRequest('request body must be JSON');
+    }
+}
+/** Validate a body or query with zod, turning failures into a 400 with a readable summary. */
+export function validate(schema, value) {
+    const result = schema.safeParse(value);
+    if (result.success)
+        return result.data;
+    const issues = result.error.issues
+        .map((i) => (i.path.length ? `${i.path.join('.')}: ${i.message}` : i.message))
+        .join('; ');
+    throw badRequest(`invalid request: ${issues}`);
+}