@band-app/server 0.60.0 → 0.60.1

package/dist/start-server.mjs

@@ -4323,11 +4323,11 @@ var require_pino = __commonJS({
       depthLimit: 5,
       edgeLimit: 100
     };
-    var normalize3 = createArgsNormalizer(defaultOptions2);
+    var normalize4 = createArgsNormalizer(defaultOptions2);
     var serializers = Object.assign(/* @__PURE__ */ Object.create(null), stdSerializers);
     function pino2(...args) {
       const instance = {};
-      const { opts, stream } = normalize3(instance, caller(), ...args);
+      const { opts, stream } = normalize4(instance, caller(), ...args);
       if (opts.level && typeof opts.level === "string" && DEFAULT_LEVELS[opts.level.toLowerCase()] !== void 0) opts.level = opts.level.toLowerCase();
       const {
         redact,
@@ -48171,27 +48171,27 @@ from generate_subscripts(${name5}, ${sql2.raw(dim.toString())}) ${aliases[dim -
 order by ${aliases[dim - 1]})`;
       return sql2`case when ${name5} is null then null else ${expression} end`;
     };
-    arrayCompatNormalize = (normalize3) => {
+    arrayCompatNormalize = (normalize4) => {
       const loop = (value, arrayDimensions) => {
         const innerDimensions = arrayDimensions - 1;
         if (arrayDimensions > 1) for (let i = 0; i < value.length; ++i) loop(value[i], innerDimensions);
-        else for (let i = 0; i < value.length; ++i) value[i] = normalize3(value[i]);
+        else for (let i = 0; i < value.length; ++i) value[i] = normalize4(value[i]);
         return value;
       };
       return loop;
     };
-    arrayCompatNormalizeInput = (normalize3, transformToPgArray = false) => {
+    arrayCompatNormalizeInput = (normalize4, transformToPgArray = false) => {
       const loop = (value, arrayDimensions) => {
         const innerDimensions = arrayDimensions - 1;
         const out = Array.from({ length: value.length });
         if (arrayDimensions > 1) for (let i = 0; i < value.length; ++i) out[i] = loop(value[i], innerDimensions);
-        else for (let i = 0; i < value.length; ++i) out[i] = normalize3(value[i]);
+        else for (let i = 0; i < value.length; ++i) out[i] = normalize4(value[i]);
         return out;
       };
       return transformToPgArray ? (v2, d) => makePgArray(loop(v2, d)) : loop;
     };
-    parsePgArrayAndNormalize = (normalize3) => {
-      const codec2 = arrayCompatNormalize(normalize3);
+    parsePgArrayAndNormalize = (normalize4) => {
+      const codec2 = arrayCompatNormalize(normalize4);
       return (value, arrayDimensions) => codec2(parsePgArray(value), arrayDimensions);
     };
     parseLineTuple = (v2) => {
@@ -88785,8 +88785,8 @@ var require_resolve = __commonJS({
       }
       return count3;
     }
-    function getFullPath(resolver, id = "", normalize3) {
-      if (normalize3 !== false)
+    function getFullPath(resolver, id = "", normalize4) {
+      if (normalize4 !== false)
         id = normalizeId(id);
       const p2 = resolver.parse(id);
       return _getFullPath(resolver, p2);
@@ -90126,7 +90126,7 @@ var require_fast_uri = __commonJS({
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
-    function normalize3(uri, options) {
+    function normalize4(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         serialize2(parse8(uri, options), options);
@@ -90362,7 +90362,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize: normalize3,
+      normalize: normalize4,
       resolve: resolve16,
       resolveComponent,
       equal,
@@ -114731,7 +114731,7 @@ init_registry();
 // package.json
 var package_default = {
   name: "@band-app/server",
-  version: "0.60.0",
+  version: "0.60.1",
   type: "module",
   types: "src/index.ts",
   exports: {
@@ -123459,18 +123459,53 @@ var directOps = {
 init_dist();
 init_zod();
 
-// src/server/services/_utils/worktree-preview-link.ts
+// src/server/services/_utils/worktree-download-link.ts
 init_state();
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual8 } from "node:crypto";
+var WORKTREE_DOWNLOAD_PREFIX = "/api/worktree-download/";
+var DOWNLOAD_TTL_MS = 5 * 60 * 1e3;
+function signingKey() {
+  const token = resolveAdminToken(process.env.BAND_ADMIN_TOKEN).token;
+  return createHmac2("sha256", token).update("worktree-download-v1").digest();
+}
+function normalize3(path2) {
+  return path2.replace(/^\/+/, "");
+}
+function sign(worktreeId4, path2, expiresAt) {
+  return createHmac2("sha256", signingKey()).update(`${worktreeId4}
+${normalize3(path2)}
+${expiresAt}`).digest("hex");
+}
+function worktreeDownloadUrl(worktreeId4, path2, now = Date.now()) {
+  const expiresAt = now + DOWNLOAD_TTL_MS;
+  const grant = `${expiresAt}.${sign(worktreeId4, path2, expiresAt)}`;
+  const encodedPath = normalize3(path2).split("/").map(encodeURIComponent).join("/");
+  return `${WORKTREE_DOWNLOAD_PREFIX}${encodeURIComponent(worktreeId4)}/${grant}/${encodedPath}`;
+}
+function verifyWorktreeDownloadGrant(worktreeId4, grant, filePath, now = Date.now()) {
+  if (filePath.includes("\0")) return false;
+  const [expiry, signature, ...extra] = grant.split(".");
+  const expiresAt = Number(expiry);
+  if (extra.length > 0 || !signature || !Number.isSafeInteger(expiresAt) || expiresAt < now) {
+    return false;
+  }
+  const expected = Buffer.from(sign(worktreeId4, filePath, expiresAt), "hex");
+  const given = Buffer.from(signature, "hex");
+  return given.length === expected.length && timingSafeEqual8(given, expected);
+}
+
+// src/server/services/_utils/worktree-preview-link.ts
+init_state();
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual9 } from "node:crypto";
 import { posix as posix10 } from "node:path";
 var WORKTREE_PREVIEW_PREFIX = "/api/worktree-preview/";
 var PREVIEW_TTL_MS = 60 * 60 * 1e3;
-function signingKey() {
+function signingKey2() {
   const token = resolveAdminToken(process.env.BAND_ADMIN_TOKEN).token;
-  return createHmac2("sha256", token).update("worktree-preview-v1").digest();
+  return createHmac3("sha256", token).update("worktree-preview-v1").digest();
 }
-function sign(worktreeId4, dir, expiresAt) {
-  return createHmac2("sha256", signingKey()).update(`${worktreeId4}
+function sign2(worktreeId4, dir, expiresAt) {
+  return createHmac3("sha256", signingKey2()).update(`${worktreeId4}
 ${dir}
 ${expiresAt}`).digest("hex");
 }
@@ -123479,7 +123514,7 @@ function worktreePreviewUrl(worktreeId4, path2, now = Date.now()) {
   const dir = posix10.dirname(path2.replace(/^\/+/, ""));
   const encodedDir = Buffer.from(dir, "utf8").toString("base64url");
   const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
-  const grant = `${expiresAt}.${encodedDir}.${sign(worktreeId4, dir, expiresAt)}`;
+  const grant = `${expiresAt}.${encodedDir}.${sign2(worktreeId4, dir, expiresAt)}`;
   return `${WORKTREE_PREVIEW_PREFIX}${encodeURIComponent(worktreeId4)}/${grant}/${encodedPath}`;
 }
 function verifyWorktreePreviewGrant(worktreeId4, grant, filePath, now = Date.now()) {
@@ -123490,9 +123525,9 @@ function verifyWorktreePreviewGrant(worktreeId4, grant, filePath, now = Date.now
     return false;
   }
   const dir = Buffer.from(encodedDir, "base64url").toString("utf8");
-  const expected = Buffer.from(sign(worktreeId4, dir, expiresAt), "hex");
+  const expected = Buffer.from(sign2(worktreeId4, dir, expiresAt), "hex");
   const given = Buffer.from(signature, "hex");
-  if (given.length !== expected.length || !timingSafeEqual8(given, expected)) return false;
+  if (given.length !== expected.length || !timingSafeEqual9(given, expected)) return false;
   const target = posix10.normalize(filePath.replace(/^\/+/, ""));
   if (target === ".." || target.startsWith("../")) return false;
   return dir === "." || target === dir || target.startsWith(`${dir}/`);
@@ -125087,14 +125122,14 @@ function asciiFuzzyIndex(input3, pattern, caseSensitive) {
   }
   return firstIdx;
 }
-var fuzzyMatchV2 = (caseSensitive, normalize3, forward, input3, pattern, withPos, slab2) => {
+var fuzzyMatchV2 = (caseSensitive, normalize4, forward, input3, pattern, withPos, slab2) => {
   const M = pattern.length;
   if (M === 0) {
     return [{ start: 0, end: 0, score: 0 }, createPosSet(withPos)];
   }
   const N = input3.length;
   if (slab2 !== null && N * M > slab2.i16.length) {
-    return fuzzyMatchV1(caseSensitive, normalize3, forward, input3, pattern, withPos);
+    return fuzzyMatchV1(caseSensitive, normalize4, forward, input3, pattern, withPos);
   }
   const idx = asciiFuzzyIndex(input3, pattern, caseSensitive);
   if (idx < 0) {
@@ -125127,7 +125162,7 @@ var fuzzyMatchV2 = (caseSensitive, normalize3, forward, input3, pattern, withPos
       if (!caseSensitive && charClass === 2) {
         char2 = String.fromCodePoint(char2).toLowerCase().codePointAt(0);
       }
-      if (normalize3) {
+      if (normalize4) {
         char2 = normalizeRune(char2);
       }
     }
@@ -125267,7 +125302,7 @@ var fuzzyMatchV2 = (caseSensitive, normalize3, forward, input3, pattern, withPos
   }
   return [{ start: j, end: maxScorePos + 1, score: maxScore }, pos];
 };
-function calculateScore(caseSensitive, normalize3, text4, pattern, sidx, eidx, withPos) {
+function calculateScore(caseSensitive, normalize4, text4, pattern, sidx, eidx, withPos) {
   let pidx = 0, score = 0, inGap = false, consecutive = 0, firstBonus = toShort(0);
   const pos = createPosSet(withPos);
   let prevCharClass = 0;
@@ -125284,7 +125319,7 @@ function calculateScore(caseSensitive, normalize3, text4, pattern, sidx, eidx, w
         rune = String.fromCodePoint(rune).toLowerCase().codePointAt(0);
       }
     }
-    if (normalize3) {
+    if (normalize4) {
       rune = normalizeRune(rune);
     }
     if (rune === pattern[pidx]) {
@@ -125323,7 +125358,7 @@ function calculateScore(caseSensitive, normalize3, text4, pattern, sidx, eidx, w
   }
   return [score, pos];
 }
-var fuzzyMatchV1 = (caseSensitive, normalize3, forward, text4, pattern, withPos, slab2) => {
+var fuzzyMatchV1 = (caseSensitive, normalize4, forward, text4, pattern, withPos, slab2) => {
   if (pattern.length === 0) {
     return [{ start: 0, end: 0, score: 0 }, null];
   }
@@ -125342,7 +125377,7 @@ var fuzzyMatchV1 = (caseSensitive, normalize3, forward, text4, pattern, withPos,
         rune = String.fromCodePoint(rune).toLowerCase().codePointAt(0);
       }
     }
-    if (normalize3) {
+    if (normalize4) {
       rune = normalizeRune(rune);
     }
     const pchar = pattern[indexAt(pidx, lenPattern, forward)];
@@ -125386,7 +125421,7 @@ var fuzzyMatchV1 = (caseSensitive, normalize3, forward, text4, pattern, withPos,
     }
     const [score, pos] = calculateScore(
       caseSensitive,
-      normalize3,
+      normalize4,
       text4,
       pattern,
       sidx,
@@ -125397,7 +125432,7 @@ var fuzzyMatchV1 = (caseSensitive, normalize3, forward, text4, pattern, withPos,
   }
   return [{ start: -1, end: -1, score: 0 }, null];
 };
-var exactMatchNaive = (caseSensitive, normalize3, forward, text4, pattern, withPos, slab2) => {
+var exactMatchNaive = (caseSensitive, normalize4, forward, text4, pattern, withPos, slab2) => {
   if (pattern.length === 0) {
     return [{ start: 0, end: 0, score: 0 }, null];
   }
@@ -125421,7 +125456,7 @@ var exactMatchNaive = (caseSensitive, normalize3, forward, text4, pattern, withP
         rune = String.fromCodePoint(rune).toLowerCase().codePointAt(0);
       }
     }
-    if (normalize3) {
+    if (normalize4) {
       rune = normalizeRune(rune);
     }
     const pidx_ = indexAt(pidx, lenPattern, forward);
@@ -125458,7 +125493,7 @@ var exactMatchNaive = (caseSensitive, normalize3, forward, text4, pattern, withP
       sidx = lenRunes - (bestPos + 1);
       eidx = lenRunes - (bestPos - lenPattern + 1);
     }
-    const [score] = calculateScore(caseSensitive, normalize3, text4, pattern, sidx, eidx, false);
+    const [score] = calculateScore(caseSensitive, normalize4, text4, pattern, sidx, eidx, false);
     return [{ start: sidx, end: eidx, score }, null];
   }
   return [{ start: -1, end: -1, score: 0 }, null];
@@ -125472,7 +125507,7 @@ function makeSlab(size16, size32) {
   };
 }
 var slab = makeSlab(SLAB_16_SIZE, SLAB_32_SIZE);
-var buildPatternForBasicMatch = (query, casing, normalize3) => {
+var buildPatternForBasicMatch = (query, casing, normalize4) => {
   let caseSensitive = false;
   switch (casing) {
     case "smart-case":
@@ -125489,7 +125524,7 @@ var buildPatternForBasicMatch = (query, casing, normalize3) => {
       break;
   }
   let queryRunes = strToRunes(query);
-  if (normalize3) {
+  if (normalize4) {
     queryRunes = queryRunes.map(normalizeRune);
   }
   return {
@@ -125966,6 +126001,13 @@ var worktreeRouter = t.router({
     }
     return { url: worktreePreviewUrl(input3.worktreeId, input3.path) };
   }),
+  /** A signed URL (5 minutes, one file) that a drag out of the Explorer hands to another app. */
+  downloadUrl: publicProcedure.input(external_exports2.object({ worktreeId: external_exports2.string(), path: external_exports2.string().min(1) })).query(({ input: input3 }) => {
+    if (!worktreeService.resolve(input3.worktreeId)) {
+      throw new TRPCError({ code: "NOT_FOUND", message: "Worktree not found" });
+    }
+    return { url: worktreeDownloadUrl(input3.worktreeId, input3.path) };
+  }),
   searchFiles: publicProcedure.input(directOps["worktree.searchFiles"].input).query(({ input: input3 }) => directOps["worktree.searchFiles"].run(worktreeOps, input3)),
   // Resolve an absolute (or worktree-relative) path against this
   // worktree: does it exist, is it a regular file, and does it live inside
@@ -126167,6 +126209,7 @@ function discoverProcedures() {
     path2.startsWith("hooks."))
       continue;
     if (path2 === "worktree.previewUrl") continue;
+    if (path2 === "worktree.downloadUrl") continue;
     if (path2 === "worktree.directAccess") continue;
     if (path2 === "worktree.readExternalFile" || path2 === "worktree.saveExternalFile") continue;
     if (path2 === "environment.validate") continue;
@@ -137489,6 +137532,39 @@ async function handleWorktreePreview(req, res) {
     isValidVisualEditNonce(nonce) ? nonce : void 0
   );
 }
+async function handleWorktreeDownload(req, res) {
+  const [rest = ""] = (req.url ?? "").slice(WORKTREE_DOWNLOAD_PREFIX.length).split("?");
+  const [rawId, grant, ...pathParts] = rest.split("/");
+  let wId;
+  let filePath;
+  try {
+    wId = decodeURIComponent(rawId ?? "");
+    filePath = decodeURIComponent(pathParts.join("/"));
+  } catch {
+    res.writeHead(400);
+    res.end("Bad request");
+    return;
+  }
+  if (!wId || !grant || !filePath) {
+    res.writeHead(400);
+    res.end("Bad request");
+    return;
+  }
+  if (!verifyWorktreeDownloadGrant(wId, grant, filePath)) {
+    res.writeHead(403);
+    res.end("Forbidden");
+    return;
+  }
+  await serveWorktreeFile(
+    res,
+    wId,
+    filePath,
+    { "X-Content-Type-Options": "nosniff", "Cache-Control": "private, no-store" },
+    void 0,
+    true,
+    req.headers.range
+  );
+}
 var MAX_WEBHOOK_BODY_BYTES = 256 * 1024;
 var MAX_GITHUB_HOOK_BODY_BYTES = 2 * 1024 * 1024;
 async function handleGithubWebhook(req, res) {
@@ -137750,6 +137826,10 @@ async function main() {
       await handleWorktreePreview(req, res);
       return;
     }
+    if (req.method === "GET" && req.url?.startsWith(WORKTREE_DOWNLOAD_PREFIX)) {
+      await handleWorktreeDownload(req, res);
+      return;
+    }
     if (handleAuth(req, res)) return;
     if (req.url?.split("?")[0] === EXT_INSTALL_PATH) {
       await handleExtensionInstall(req, res, requestDevice(req).admin);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@band-app/server",
-  "version": "0.60.0",
+  "version": "0.60.1",
   "type": "module",
   "types": "src/index.ts",
   "exports": {
@@ -58,24 +58,24 @@
     "vitest": "^4.0.18",
     "ws": "^8.18.0",
     "zod": "^3.25.67",
+    "@band-app/coding-agent": "^0.60.1",
     "@band-app/environment": "^0.1.0",
-    "@band-app/coding-agent": "^0.60.0",
     "@band-app/host-api": "^0.1.0",
-    "@band-app/chat-runtime": "^0.1.0",
     "@band-app/host-local": "^0.1.0",
+    "@band-app/chat-runtime": "^0.1.0",
     "@band-app/host-remote": "^0.1.0",
-    "@band-app/logger": "^0.60.0",
+    "@band-app/logger": "^0.60.1",
     "@band-app/plugin-api": "^0.1.0",
+    "@band-app/link": "^0.1.0",
+    "@band-app/plugin-github": "^0.1.0",
     "@band-app/shared": "^0.1.0",
     "@band-app/worktree-ops": "^0.1.0",
-    "@band-app/plugin-github": "^0.1.0",
-    "@band-app/plugin-simulator": "^0.1.0",
-    "@band-app/link": "^0.1.0"
+    "@band-app/plugin-simulator": "^0.1.0"
   },
   "optionalDependencies": {
-    "@band-app/worker-cli-darwin-arm64": "0.60.0",
-    "@band-app/worker-cli-linux-x64": "0.60.0",
-    "@band-app/worker-cli-linux-arm64": "0.60.0"
+    "@band-app/worker-cli-darwin-arm64": "0.60.1",
+    "@band-app/worker-cli-linux-x64": "0.60.1",
+    "@band-app/worker-cli-linux-arm64": "0.60.1"
   },
   "scripts": {
     "dev": "NODE_ENV=development tsx watch --exclude '../web/**' start-server.ts",

package/dist/client/assets/channel-DaBOqDcm.js

@@ -1 +0,0 @@
-import{Y as a,Z as n}from"./main-CW1tJAHn.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/client/assets/classDiagram-2ON5EDUG-CovRsOYg.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-B4BG7PRW-CAtAtkCf.js";import{_ as i}from"./main-CW1tJAHn.js";import"./chunk-FMBD7UC4-DzqqzV_F.js";import"./chunk-55IACEB6-DO5fHd1T.js";import"./chunk-QN33PNHL-DETRpC4Q.js";var p={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{p as diagram};

package/dist/client/assets/classDiagram-v2-WZHVMYZB-CovRsOYg.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-B4BG7PRW-CAtAtkCf.js";import{_ as i}from"./main-CW1tJAHn.js";import"./chunk-FMBD7UC4-DzqqzV_F.js";import"./chunk-55IACEB6-DO5fHd1T.js";import"./chunk-QN33PNHL-DETRpC4Q.js";var p={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{p as diagram};

package/dist/client/assets/clone-CEAieby9.js

@@ -1 +0,0 @@
-import{b as r}from"./_baseUniq-vhCiyIYf.js";var e=4;function a(o){return r(o,e)}export{a as c};

package/dist/client/assets/stateDiagram-v2-4FDKWEC3-D0LqsI9r.js

@@ -1 +0,0 @@
-import{s as t,b as r,a,S as s}from"./chunk-DI55MBZ5-DRnZO_Tx.js";import{_ as i}from"./main-CW1tJAHn.js";import"./chunk-55IACEB6-DO5fHd1T.js";import"./chunk-QN33PNHL-DETRpC4Q.js";var l={parser:a,get db(){return new s(2)},renderer:r,styles:t,init:i(e=>{e.state||(e.state={}),e.state.arrowMarkerAbsolute=e.arrowMarkerAbsolute},"init")};export{l as diagram};