@chainingintention/pi-web-cn 1.202606.4 → 1.202606.5

package/dist/server/managementEmbed.js

@@ -0,0 +1,205 @@
+import { mkdir, realpath } from "node:fs/promises";
+import { join, relative, resolve, sep, isAbsolute } from "node:path";
+export const MANAGEMENT_EMBED_MODE_HEADER = "x-pi-web-embed-mode";
+export const MANAGEMENT_EMBED_TOKEN_HEADER = "x-pi-web-embed-token";
+export const MANAGEMENT_EMBED_CONTEXT_HEADER = "x-pi-web-management-context";
+const MANAGEMENT_FORCE_DENY_TOOLS = new Set(["bash", "shell", "terminal", "terminal-command-runs"]);
+export function readManagementEmbedRequest(headers, query) {
+    const modeHeader = firstHeader(headers[MANAGEMENT_EMBED_MODE_HEADER]);
+    const tokenHeader = firstHeader(headers[MANAGEMENT_EMBED_TOKEN_HEADER]);
+    const embedQuery = typeof query?.["embed"] === "string" ? query["embed"].trim() : undefined;
+    const tokenQuery = typeof query?.["token"] === "string" ? query["token"].trim() : undefined;
+    const isManagement = modeHeader === "management" || embedQuery === "management" || tokenHeader !== undefined || tokenQuery !== undefined;
+    const token = tokenHeader ?? tokenQuery;
+    return {
+        ...(isManagement ? { mode: "management" } : {}),
+        ...(token === undefined ? {} : { token }),
+    };
+}
+export async function managementContextForRequest(request, runtime) {
+    const embed = readManagementEmbedRequest(request.headers, isRecord(request.query) ? request.query : undefined);
+    if (embed.mode !== "management")
+        return undefined;
+    if (runtime?.enabled !== true)
+        throw new Error("Management embed mode is not configured");
+    if (embed.token === undefined || embed.token === "")
+        throw new Error("Management embed token is required");
+    return runtime.authenticate(embed.token);
+}
+export function createManagementEmbedRuntime(config, env = process.env) {
+    if (config?.enabled !== true)
+        return undefined;
+    const introspectionUrl = config.auth?.introspectionUrl?.trim();
+    const configuredServiceSecretEnv = config.auth?.serviceSecretEnv?.trim();
+    const serviceSecretEnv = configuredServiceSecretEnv !== undefined && configuredServiceSecretEnv !== "" ? configuredServiceSecretEnv : "PI_WEB_MANAGEMENT_EMBED_SERVICE_TOKEN";
+    const serviceSecret = env[serviceSecretEnv]?.trim();
+    if (introspectionUrl === undefined || introspectionUrl === "" || serviceSecret === undefined || serviceSecret === "") {
+        return {
+            enabled: true,
+            projectRoot: config.projectRoot ?? "/root/Piweb",
+            authenticate: () => Promise.reject(new Error("Management embed auth is not configured")),
+        };
+    }
+    return {
+        enabled: true,
+        projectRoot: config.projectRoot ?? "/root/Piweb",
+        authenticate: async (token) => introspectManagementToken(introspectionUrl, serviceSecret, token),
+    };
+}
+export async function managedProjectPath(projectRoot, rootUserId, projectId) {
+    const root = await ensureRealDirectory(projectRoot);
+    const requested = join(root, safePathSegment(rootUserId), safePathSegment(projectId));
+    ensureInside(root, requested);
+    await mkdir(requested, { recursive: true });
+    const target = await realpath(requested);
+    ensureInside(root, target);
+    return target;
+}
+export async function projectFromManagedEmbedContext(projectRoot, context, projectId) {
+    const entry = context.projects.find((project) => project.id === projectId);
+    if (entry === undefined)
+        throw new Error("Project is not authorized for this management session");
+    const entryRoot = entry.root?.trim();
+    const path = entryRoot !== undefined && entryRoot !== ""
+        ? await assertManagedCwd(projectRoot, context, entryRoot)
+        : await managedProjectPath(projectRoot, context.user.rootUserId, entry.id);
+    return { id: entry.id, name: entry.name !== "" ? entry.name : entry.id, path, createdAt: new Date(0).toISOString() };
+}
+export async function projectsFromManagedEmbedContext(projectRoot, context) {
+    return Promise.all(context.projects.map((project) => projectFromManagedEmbedContext(projectRoot, context, project.id)));
+}
+export async function assertManagedCwd(projectRoot, context, cwd) {
+    const root = await ensureRealDirectory(projectRoot);
+    const requested = await realpath(resolve(cwd));
+    ensureInside(root, requested);
+    const authorizedRoots = await Promise.all(context.projects.map(async (project) => {
+        const projectRootOverride = project.root?.trim();
+        if (projectRootOverride !== undefined && projectRootOverride !== "")
+            return realpath(resolve(projectRootOverride));
+        return managedProjectPath(root, context.user.rootUserId, project.id);
+    }));
+    if (!authorizedRoots.some((authorized) => isInside(authorized, requested))) {
+        throw new Error("Path is outside the managed project sandbox");
+    }
+    return requested;
+}
+export function managementToolAllowed(context, tool) {
+    if (MANAGEMENT_FORCE_DENY_TOOLS.has(tool))
+        return false;
+    const deny = new Set(context.tools?.deny ?? []);
+    if (deny.has(tool))
+        return false;
+    const allow = context.tools?.allow;
+    return allow === undefined || allow.length === 0 || allow.includes(tool);
+}
+export function encodeManagementContext(context) {
+    return Buffer.from(JSON.stringify(context), "utf8").toString("base64url");
+}
+export function decodeManagementContext(value) {
+    if (value === undefined || value === "")
+        return undefined;
+    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    if (!isRecord(parsed))
+        throw new Error("Invalid management embed context");
+    return parseIntrospectionPayload({ active: true, ...parsed });
+}
+async function introspectManagementToken(url, serviceSecret, token) {
+    const response = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-pi-web-embed-secret": serviceSecret },
+        body: JSON.stringify({ token }),
+    });
+    const payload = await response.json().catch(() => undefined);
+    if (!response.ok || !isRecord(payload) || payload["active"] !== true)
+        throw new Error("Management embed token is invalid");
+    return parseIntrospectionPayload(payload);
+}
+function parseIntrospectionPayload(payload) {
+    const user = payload["user"];
+    const projects = payload["projects"];
+    if (!isRecord(user) || !Array.isArray(projects))
+        throw new Error("Management embed introspection response is invalid");
+    const context = {
+        user: {
+            id: stringField(user, "id"),
+            rootUserId: stringField(user, "rootUserId"),
+            roles: stringArray(user["roles"]),
+            permissions: stringArray(user["permissions"]),
+        },
+        projects: projects.map(parseProjectEntry),
+    };
+    if (isRecord(payload["tools"]))
+        context.tools = parseTools(payload["tools"]);
+    if (isRecord(payload["sandbox"]))
+        context.sandbox = parseSandbox(payload["sandbox"]);
+    if (typeof payload["expiresAt"] === "string")
+        context.expiresAt = payload["expiresAt"];
+    return context;
+}
+function parseTools(value) {
+    return {
+        ...(Array.isArray(value["allow"]) ? { allow: stringArray(value["allow"]) } : {}),
+        ...(Array.isArray(value["deny"]) ? { deny: stringArray(value["deny"]) } : {}),
+        ...(isRecord(value["permissions"]) ? { permissions: booleanRecord(value["permissions"]) } : {}),
+    };
+}
+function parseSandbox(value) {
+    return {
+        ...(typeof value["pythonExecutable"] === "string" ? { pythonExecutable: value["pythonExecutable"] } : {}),
+        ...(isRecord(value["env"]) ? { env: stringRecord(value["env"]) } : {}),
+    };
+}
+function parseProjectEntry(value) {
+    if (!isRecord(value))
+        throw new Error("Management embed project entry is invalid");
+    return {
+        id: stringField(value, "id"),
+        name: stringField(value, "name"),
+        ...(typeof value["role"] === "string" ? { role: value["role"] } : {}),
+        ...(typeof value["root"] === "string" ? { root: value["root"] } : {}),
+    };
+}
+async function ensureRealDirectory(path) {
+    await mkdir(path, { recursive: true });
+    return realpath(path);
+}
+function firstHeader(value) {
+    const header = Array.isArray(value) ? value[0] : value;
+    const normalized = header?.trim();
+    return normalized === "" ? undefined : normalized;
+}
+function safePathSegment(value) {
+    const segment = value.trim().replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+    return segment === "" ? "unknown" : segment;
+}
+function ensureInside(root, target) {
+    if (!isInside(root, target))
+        throw new Error("Path is outside the managed project sandbox");
+}
+function isInside(root, target) {
+    const rel = relative(root, target);
+    if (rel === "")
+        return true;
+    if (rel.startsWith("..") || isAbsolute(rel))
+        return false;
+    return sep === "/" || !rel.split(sep).includes("..");
+}
+function stringField(value, key) {
+    const field = value[key];
+    if (typeof field !== "string" || field.trim() === "")
+        throw new Error(`Management embed ${key} is required`);
+    return field.trim();
+}
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string" && item.trim() !== "").map((item) => item.trim()) : [];
+}
+function stringRecord(value) {
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function booleanRecord(value) {
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "boolean"));
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=managementEmbed.js.map

package/dist/server/managementEmbed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementEmbed.js","sourceRoot":"","sources":["../../src/server/managementEmbed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAKrE,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAC7E,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC;AA0BpG,MAAM,UAAU,0BAA0B,CAAC,OAAsD,EAAE,KAA+B;IAChI,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,YAAY,GAAG,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,YAAY,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC;IACzI,MAAM,KAAK,GAAG,WAAW,IAAI,UAAU,CAAC;IACxC,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAuB,EAAE,OAA2C;IACpH,MAAM,KAAK,GAAG,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/G,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,OAAO,EAAE,OAAO,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC3G,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAA8C,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC/H,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,0BAA0B,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,gBAAgB,GAAG,0BAA0B,KAAK,SAAS,IAAI,0BAA0B,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uCAAuC,CAAC;IAC9K,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,EAAE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACrH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,aAAa;YAChD,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;SACzF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,aAAa;QAChD,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,gBAAgB,EAAE,aAAa,EAAE,KAAK,CAAC;KACjG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAE,UAAkB,EAAE,SAAiB;IACjG,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACtF,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,WAAmB,EAAE,OAA+B,EAAE,SAAiB;IAC1H,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QACtD,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;QACzD,CAAC,CAAC,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,WAAmB,EAAE,OAA+B;IACxG,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,8BAA8B,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB,EAAE,OAA+B,EAAE,GAAW;IACtG,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/E,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACnH,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAE,IAAY;IACjF,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;IACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3E,OAAO,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,GAAW,EAAE,aAAqB,EAAE,KAAa;IACxF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,EAAE;QACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3H,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvH,MAAM,OAAO,GAA2B;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;YAC3B,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC;YAC3C,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;SAC9C;QACD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;KAC1C,CAAC;IACF,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B;IAChD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC;QAC5B,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;QAChC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAClC,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,GAAW;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,cAAc,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvJ,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;AAChI,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/server/sessiond/sessionProxyRoutes.js

@@ -1,9 +1,12 @@
 import { WebSocket } from "ws";
 import { SessionDaemonClient } from "../../sessiond/sessionDaemonClient.js";
-export function registerSessionProxyRoutes(app, daemon = new SessionDaemonClient(), prefix = "/api") {
+import { assertManagedCwd, encodeManagementContext, managementContextForRequest, MANAGEMENT_EMBED_CONTEXT_HEADER } from "../managementEmbed.js";
+export function registerSessionProxyRoutes(app, daemon = new SessionDaemonClient(), prefix = "/api", managementEmbed) {
     const proxy = async (request, reply) => {
         try {
-            const upstream = await daemon.request(request.method, stripPrefix(request.url, prefix), request.body);
+            const managementContext = await managementContextForRequest(request, managementEmbed);
+            const body = await managementBody(request.url, request.body, managementContext, managementEmbed);
+            const upstream = await daemon.request(request.method, stripPrefix(request.url, prefix), body, managementHeaders(managementContext));
             reply.code(upstream.statusCode);
             const contentType = upstream.headers["content-type"];
             if (contentType !== undefined && contentType !== "")
@@ -15,15 +18,40 @@ export function registerSessionProxyRoutes(app, daemon = new SessionDaemonClient
             return undefined;
         }
     };
-    app.get(`${prefix}/sessiond/health`, (_request, reply) => proxy({ method: "GET", url: `${prefix}/health` }, reply));
+    app.get(`${prefix}/sessiond/health`, async (_request, reply) => {
+        try {
+            const upstream = await daemon.request("GET", "/health");
+            reply.code(upstream.statusCode);
+            const contentType = upstream.headers["content-type"];
+            if (contentType !== undefined && contentType !== "")
+                reply.header("content-type", contentType);
+            return upstream.body !== "" ? parseJson(upstream.body) : undefined;
+        }
+        catch (error) {
+            requestFailed(reply, error);
+            return undefined;
+        }
+    });
     app.get(`${prefix}/sessions/:sessionId/events`, { websocket: true }, (socket, request) => {
-        bridgeSockets(socket, daemon.connectWebSocket(`/sessions/${request.params.sessionId}/events`));
+        void managementContextForRequest(request, managementEmbed).then((context) => {
+            bridgeSockets(socket, daemon.connectWebSocket(`/sessions/${request.params.sessionId}/events`, managementHeaders(context)));
+        }).catch((error) => {
+            closeSocketWithError(socket, error);
+        });
     });
-    app.get(`${prefix}/sessions/events`, { websocket: true }, (socket) => {
-        bridgeSockets(socket, daemon.connectWebSocket("/sessions/events"));
+    app.get(`${prefix}/sessions/events`, { websocket: true }, (socket, request) => {
+        void managementContextForRequest(request, managementEmbed).then((context) => {
+            bridgeSockets(socket, daemon.connectWebSocket("/sessions/events", managementHeaders(context)));
+        }).catch((error) => {
+            closeSocketWithError(socket, error);
+        });
     });
-    app.get(`${prefix}/events`, { websocket: true }, (socket) => {
-        bridgeSockets(socket, daemon.connectWebSocket("/events"));
+    app.get(`${prefix}/events`, { websocket: true }, (socket, request) => {
+        void managementContextForRequest(request, managementEmbed).then((context) => {
+            bridgeSockets(socket, daemon.connectWebSocket("/events", managementHeaders(context)));
+        }).catch((error) => {
+            closeSocketWithError(socket, error);
+        });
     });
     app.all(`${prefix}/activity`, (request, reply) => proxy(request, reply));
     app.all(`${prefix}/auth`, (request, reply) => proxy(request, reply));
@@ -31,6 +59,29 @@ export function registerSessionProxyRoutes(app, daemon = new SessionDaemonClient
     app.all(`${prefix}/sessions`, (request, reply) => proxy(request, reply));
     app.all(`${prefix}/sessions/*`, (request, reply) => proxy(request, reply));
 }
+async function managementBody(url, body, context, managementEmbed) {
+    if (context === undefined)
+        return body;
+    const path = stripPrefix(url, "");
+    if (path.startsWith("/sessions?")) {
+        const cwd = new URL(`http://local${path}`).searchParams.get("cwd");
+        if (cwd !== null)
+            await assertManagedCwd(managementProjectRoot(managementEmbed), context, cwd);
+        return body;
+    }
+    if (path === "/sessions" && isRecord(body) && typeof body["cwd"] === "string") {
+        return { ...body, cwd: await assertManagedCwd(managementProjectRoot(managementEmbed), context, body["cwd"]) };
+    }
+    return body;
+}
+function managementHeaders(context) {
+    return context === undefined ? undefined : { [MANAGEMENT_EMBED_CONTEXT_HEADER]: encodeManagementContext(context) };
+}
+function managementProjectRoot(managementEmbed) {
+    if (managementEmbed === undefined)
+        throw new Error("Management embed mode is not configured");
+    return managementEmbed.projectRoot;
+}
 function stripPrefix(url, prefix) {
     const path = url.split("?", 1)[0] ?? url;
     const query = url.slice(path.length);
@@ -57,4 +108,11 @@ function sendIfOpen(socket, data) {
         socket.send(data);
     }
 }
+function closeSocketWithError(socket, error) {
+    socket.send(JSON.stringify({ type: "error", message: error instanceof Error ? error.message : String(error) }));
+    socket.close();
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //# sourceMappingURL=sessionProxyRoutes.js.map

package/dist/server/sessiond/sessionProxyRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionProxyRoutes.js","sourceRoot":"","sources":["../../../src/server/sessiond/sessionProxyRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAgB,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,MAAM,UAAU,0BAA0B,CAAC,GAAoB,EAAE,SAA6B,IAAI,mBAAmB,EAAE,EAAE,MAAM,GAAG,MAAM;IACtI,MAAM,KAAK,GAAG,KAAK,EAAE,OAAwD,EAAE,KAAmB,EAAE,EAAE;QACpG,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACtG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;gBAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC/F,OAAO,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpH,GAAG,CAAC,GAAG,CAAoC,GAAG,MAAM,6BAA6B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC1H,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;QACnE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1D,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACxF,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,KAAc;IACxD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB,EAAE,QAAmB;IAC3D,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAa;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}
+{"version":3,"file":"sessionProxyRoutes.js","sourceRoot":"","sources":["../../../src/server/sessiond/sessionProxyRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAgB,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,+BAA+B,EAA4D,MAAM,uBAAuB,CAAC;AAO1M,MAAM,UAAU,0BAA0B,CAAC,GAAoB,EAAE,SAA6B,IAAI,mBAAmB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,eAAwC;IAChL,MAAM,KAAK,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;YACjG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;gBAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC/F,OAAO,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC7D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;gBAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC/F,OAAO,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAoC,GAAG,MAAM,6BAA6B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC1H,KAAK,2BAA2B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1E,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7H,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC5E,KAAK,2BAA2B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1E,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QACnE,KAAK,2BAA2B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1E,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,IAAa,EAAE,OAA2C,EAAE,eAAmD;IACxJ,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9E,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA2C;IACpE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,+BAA+B,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;AACrH,CAAC;AAED,SAAS,qBAAqB,CAAC,eAAmD;IAChF,IAAI,eAAe,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC9F,OAAO,eAAe,CAAC,WAAW,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACxF,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,KAAc;IACxD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB,EAAE,QAAmB;IAC3D,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAa;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAiB,EAAE,KAAc;IAC7D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/server/sessions/managementPermissionSystem.js

@@ -0,0 +1,94 @@
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+export const PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR = "PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR";
+const MANAGEMENT_AGENT_TOOL_NAMES = ["read", "write", "edit", "ls", "grep", "find", "python"];
+export function createManagementPermissionSystemPolicy(context) {
+    const tools = {
+        "*": "deny",
+    };
+    for (const tool of managementAgentToolNames(context))
+        tools[tool] = "allow";
+    for (const tool of managementDeniedToolNames(context))
+        tools[tool] = "deny";
+    return {
+        defaultPolicy: {
+            tools: "deny",
+            bash: "deny",
+            mcp: "deny",
+            skills: "deny",
+            special: "deny",
+        },
+        tools,
+        bash: { "*": "deny" },
+        mcp: { "*": "deny" },
+        skills: { "*": "deny" },
+        special: {
+            doom_loop: "deny",
+            external_directory: "deny",
+        },
+    };
+}
+export function managementAgentToolNames(context) {
+    const deny = new Set([...(context.tools?.deny ?? []), "bash", "shell", "terminal"]);
+    const allow = context.tools?.allow;
+    const safeTools = MANAGEMENT_AGENT_TOOL_NAMES.filter((tool) => !deny.has(tool));
+    if (allow === undefined || allow.length === 0)
+        return [...safeTools];
+    return safeTools.filter((tool) => allow.includes(tool));
+}
+export async function writeManagementPermissionSystemPolicy(agentDir, cwd, context) {
+    const policyAgentDir = join(agentDir, "management-embed", "permission-system", safePathSegment(context.user.rootUserId), createHash("sha256").update(cwd).digest("hex").slice(0, 16));
+    await mkdir(policyAgentDir, { recursive: true });
+    await writeFile(join(policyAgentDir, "pi-permissions.jsonc"), `${JSON.stringify(createManagementPermissionSystemPolicy(context), null, 2)}\n`, "utf8");
+    return policyAgentDir;
+}
+let runtimeEnvironmentQueue = Promise.resolve();
+export async function withRuntimeCreationEnvironment(env, action) {
+    const previousQueue = runtimeEnvironmentQueue;
+    let releaseQueue = () => undefined;
+    runtimeEnvironmentQueue = new Promise((resolve) => {
+        releaseQueue = resolve;
+    });
+    await previousQueue;
+    const previousValues = new Map();
+    for (const [key, value] of Object.entries(env)) {
+        previousValues.set(key, process.env[key]);
+        if (value === undefined)
+            Reflect.deleteProperty(process.env, key);
+        else
+            process.env[key] = value;
+    }
+    try {
+        return await action();
+    }
+    finally {
+        for (const [key, value] of previousValues) {
+            if (value === undefined)
+                Reflect.deleteProperty(process.env, key);
+            else
+                process.env[key] = value;
+        }
+        releaseQueue();
+    }
+}
+function managementDeniedToolNames(context) {
+    return [
+        "bash",
+        "shell",
+        "terminal",
+        "terminal-command-runs",
+        "powershell",
+        "pwsh",
+        "mcp",
+        "http",
+        "webfetch",
+        "websearch",
+        ...(context.tools?.deny ?? []),
+    ];
+}
+function safePathSegment(value) {
+    const safe = value.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+    return safe === "" ? "user" : safe.slice(0, 80);
+}
+//# sourceMappingURL=managementPermissionSystem.js.map

package/dist/server/sessions/managementPermissionSystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementPermissionSystem.js","sourceRoot":"","sources":["../../../src/server/sessions/managementPermissionSystem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,MAAM,qCAAqC,GAAG,uCAAuC,CAAC;AAC7F,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAsBvG,MAAM,UAAU,sCAAsC,CAAC,OAA+B;IACpF,MAAM,KAAK,GAAoC;QAC7C,GAAG,EAAE,MAAM;KACZ,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,wBAAwB,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI,yBAAyB,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAE5E,OAAO;QACL,aAAa,EAAE;YACb,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM;SAChB;QACD,KAAK;QACL,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;QACrB,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;QACpB,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;QACvB,OAAO,EAAE;YACP,SAAS,EAAE,MAAM;YACjB,kBAAkB,EAAE,MAAM;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA+B;IACtE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;IACnC,MAAM,SAAS,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,QAAgB,EAAE,GAAW,EAAE,OAA+B;IACxH,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACtL,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,sCAAsC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvJ,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,IAAI,uBAAuB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAI,GAAuC,EAAE,MAAwB;IACvH,MAAM,aAAa,GAAG,uBAAuB,CAAC;IAC9C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;IAC/C,uBAAuB,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACtD,YAAY,GAAG,OAAO,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,CAAC;IAEpB,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;YAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAChC,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;gBAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAChC,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,OAA+B;IAChE,OAAO;QACL,MAAM;QACN,OAAO;QACP,UAAU;QACV,uBAAuB;QACvB,YAAY;QACZ,MAAM;QACN,KAAK;QACL,MAAM;QACN,UAAU;QACV,WAAW;QACX,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/server/sessions/managementSandbox.js

@@ -0,0 +1,156 @@
+const DEFAULT_PATH = "/usr/local/bin:/usr/bin:/bin";
+const SAFE_HOST_ENV_KEYS = ["PATH", "LANG", "LC_ALL", "LC_CTYPE"];
+const SENSITIVE_ENV_PATTERNS = ["TOKEN", "SECRET", "PASSWORD", "PRIVATE_KEY", "API_KEY"];
+const SANDBOX_WORKSPACE = "/workspace";
+const SANDBOX_HOME = "/tmp/pi-web-home";
+export const DEFAULT_BUBBLEWRAP_PATHS = [
+    "/usr",
+    "/bin",
+    "/lib",
+    "/lib64",
+    "/etc/alternatives",
+    "/etc/ld.so.cache",
+    "/etc/ssl",
+    "/etc/ca-certificates",
+];
+export function createManagedSandboxEnvironment(options) {
+    const env = {};
+    for (const key of SAFE_HOST_ENV_KEYS) {
+        const value = options.hostEnv[key];
+        if (value !== undefined && value !== "")
+            env[key] = value;
+    }
+    env["PATH"] ??= DEFAULT_PATH;
+    for (const [key, value] of Object.entries(options.context.sandbox?.env ?? {})) {
+        assertNonSensitiveSandboxEnvKey(key);
+        env[key] = value;
+    }
+    env["HOME"] = SANDBOX_HOME;
+    env["TMPDIR"] = "/tmp";
+    return env;
+}
+export function createBubblewrapPythonInvocation(options) {
+    const args = [
+        "--unshare-net",
+        "--unshare-ipc",
+        "--unshare-pid",
+        "--die-with-parent",
+        "--clearenv",
+        ...Object.entries(options.env ?? {}).flatMap(([key, value]) => ["--setenv", key, value ?? ""]),
+        "--tmpfs",
+        "/tmp",
+        "--dir",
+        SANDBOX_HOME,
+        "--proc",
+        "/proc",
+        "--dev",
+        "/dev",
+        ...[...new Set(options.readOnlyPaths ?? DEFAULT_BUBBLEWRAP_PATHS)].flatMap((path) => ["--ro-bind", path, path]),
+        "--bind",
+        options.workspaceRoot,
+        SANDBOX_WORKSPACE,
+        "--chdir",
+        SANDBOX_WORKSPACE,
+        options.pythonExecutable,
+        "-I",
+        "-",
+    ];
+    return { command: options.bubblewrapExecutable, args };
+}
+export function bubblewrapUnavailableReason(output) {
+    if (output.includes("setting up uid map: Permission denied"))
+        return "setting up uid map: Permission denied";
+    if (output.includes("Failed RTM_NEWADDR: Operation not permitted"))
+        return "Failed RTM_NEWADDR: Operation not permitted";
+    if (output.includes("No permissions to creating new namespace"))
+        return "No permissions to creating new namespace";
+    if (output.includes("Creating new namespace failed"))
+        return "Creating new namespace failed";
+    return undefined;
+}
+export function createManagedPythonFallbackPrelude(root) {
+    return `
+import builtins
+import io
+import os
+import pathlib
+import subprocess
+
+_PI_WEB_ROOT = ${JSON.stringify(root)}
+_PI_WEB_OPEN = builtins.open
+_PI_WEB_IO_OPEN = io.open
+_PI_WEB_PATH_OPEN = pathlib.Path.open
+_PI_WEB_PATH_READ_TEXT = pathlib.Path.read_text
+_PI_WEB_PATH_READ_BYTES = pathlib.Path.read_bytes
+_PI_WEB_PATH_WRITE_TEXT = pathlib.Path.write_text
+_PI_WEB_PATH_WRITE_BYTES = pathlib.Path.write_bytes
+
+def _pi_web_inside(path):
+    real = os.path.realpath(os.fspath(path))
+    rel = os.path.relpath(real, _PI_WEB_ROOT)
+    return rel == "." or (not rel.startswith("..") and not os.path.isabs(rel))
+
+def _pi_web_check_path(path):
+    if not isinstance(path, (str, bytes, os.PathLike)):
+        return
+    if not _pi_web_inside(path):
+        raise PermissionError("path outside the managed project sandbox: %s" % path)
+
+def open(file, mode="r", *args, **kwargs):
+    _pi_web_check_path(file)
+    return _PI_WEB_OPEN(file, mode, *args, **kwargs)
+
+def _pi_web_path_open(self, *args, **kwargs):
+    _pi_web_check_path(self)
+    return _PI_WEB_PATH_OPEN(self, *args, **kwargs)
+
+def _pi_web_path_read_text(self, *args, **kwargs):
+    _pi_web_check_path(self)
+    return _PI_WEB_PATH_READ_TEXT(self, *args, **kwargs)
+
+def _pi_web_path_read_bytes(self, *args, **kwargs):
+    _pi_web_check_path(self)
+    return _PI_WEB_PATH_READ_BYTES(self, *args, **kwargs)
+
+def _pi_web_path_write_text(self, *args, **kwargs):
+    _pi_web_check_path(self)
+    return _PI_WEB_PATH_WRITE_TEXT(self, *args, **kwargs)
+
+def _pi_web_path_write_bytes(self, *args, **kwargs):
+    _pi_web_check_path(self)
+    return _PI_WEB_PATH_WRITE_BYTES(self, *args, **kwargs)
+
+def _pi_web_blocked_os_path(path, *args, **kwargs):
+    _pi_web_check_path(path)
+    raise PermissionError("low-level os path APIs are disabled in managed Python fallback mode")
+
+def _pi_web_blocked_process(*args, **kwargs):
+    raise PermissionError("subprocess and shell execution are disabled in managed Python fallback mode")
+
+builtins.open = open
+io.open = open
+pathlib.Path.open = _pi_web_path_open
+pathlib.Path.read_text = _pi_web_path_read_text
+pathlib.Path.read_bytes = _pi_web_path_read_bytes
+pathlib.Path.write_text = _pi_web_path_write_text
+pathlib.Path.write_bytes = _pi_web_path_write_bytes
+os.open = _pi_web_blocked_os_path
+os.listdir = _pi_web_blocked_os_path
+os.scandir = _pi_web_blocked_os_path
+os.stat = _pi_web_blocked_os_path
+os.lstat = _pi_web_blocked_os_path
+subprocess.Popen = _pi_web_blocked_process
+subprocess.run = _pi_web_blocked_process
+subprocess.call = _pi_web_blocked_process
+subprocess.check_call = _pi_web_blocked_process
+subprocess.check_output = _pi_web_blocked_process
+os.system = _pi_web_blocked_process
+`;
+}
+function assertNonSensitiveSandboxEnvKey(key) {
+    const upper = key.toUpperCase();
+    if (SENSITIVE_ENV_PATTERNS.some((pattern) => upper.includes(pattern))) {
+        throw new Error(`Sensitive sandbox environment variable is not allowed: ${key}`);
+    }
+}
+//# sourceMappingURL=managementSandbox.js.map

package/dist/server/sessions/managementSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementSandbox.js","sourceRoot":"","sources":["../../../src/server/sessions/managementSandbox.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,8BAA8B,CAAC;AACpD,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;AAC3E,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAClG,MAAM,iBAAiB,GAAG,YAAY,CAAC;AACvC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,mBAAmB;IACnB,kBAAkB;IAClB,UAAU;IACV,sBAAsB;CACd,CAAC;AAoBX,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACvF,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5D,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC;IAE7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9E,+BAA+B,CAAC,GAAG,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC;IAC3B,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,OAA0C;IACzF,MAAM,IAAI,GAAG;QACX,eAAe;QACf,eAAe;QACf,eAAe;QACf,mBAAmB;QACnB,YAAY;QACZ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,SAAS;QACT,MAAM;QACN,OAAO;QACP,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/G,QAAQ;QACR,OAAO,CAAC,aAAa;QACrB,iBAAiB;QACjB,SAAS;QACT,iBAAiB;QACjB,OAAO,CAAC,gBAAgB;QACxB,IAAI;QACJ,GAAG;KACJ,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,IAAI,MAAM,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QAAE,OAAO,uCAAuC,CAAC;IAC7G,IAAI,MAAM,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACzH,IAAI,MAAM,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QAAE,OAAO,0CAA0C,CAAC;IACnH,IAAI,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC7F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,IAAY;IAC7D,OAAO;;;;;;;iBAOQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEpC,CAAC;AACF,CAAC;AAED,SAAS,+BAA+B,CAAC,GAAW;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,0DAA0D,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}