@cloudcli-ai/cloudcli 1.36.3 → 1.37.1

package/server/modules/agent/index.ts

@@ -0,0 +1,2 @@
+// createAgentModule: used by the server entrypoint to assemble Agent routes with provider runtimes.
+export { createAgentModule } from './agent.module.js';

package/server/modules/agent/tests/agent.routes.test.ts

@@ -0,0 +1,205 @@
+import assert from 'node:assert/strict';
+import * as nodeCrypto from 'node:crypto';
+import { EventEmitter, once } from 'node:events';
+import type { AddressInfo } from 'node:net';
+import { PassThrough } from 'node:stream';
+import test from 'node:test';
+
+import express from 'express';
+
+import { createAgentRouter } from '../agent.routes.js';
+
+type AgentDependencies = Parameters<typeof createAgentRouter>[0];
+
+function createDependencies(
+  overrides: Partial<AgentDependencies> = {},
+): AgentDependencies {
+  const unexpectedProviderCall = async (): Promise<never> => {
+    throw new Error('Provider runtime should not be called');
+  };
+
+  return {
+    fileSystem: {} as AgentDependencies['fileSystem'],
+    crypto: nodeCrypto,
+    homeDirectory: () => '/home/test',
+    spawnProcess: (() => { throw new Error('spawn should not run'); }) as unknown as
+      AgentDependencies['spawnProcess'],
+    platformMode: true,
+    users: { getFirstUser: () => ({ id: 1, username: 'test-user' }) },
+    apiKeys: { validateApiKey: () => undefined },
+    githubTokens: { getActiveGithubToken: () => null },
+    projects: { createProjectPath: () => ({ outcome: 'created' }) },
+    models: {} as AgentDependencies['models'],
+    queryClaude: unexpectedProviderCall as AgentDependencies['queryClaude'],
+    queryCursor: unexpectedProviderCall as AgentDependencies['queryCursor'],
+    queryCodex: unexpectedProviderCall as AgentDependencies['queryCodex'],
+    queryOpenCode: unexpectedProviderCall as AgentDependencies['queryOpenCode'],
+    GithubClient: class {} as unknown as AgentDependencies['GithubClient'],
+    ...overrides,
+  };
+}
+
+async function withAgentServer(
+  dependencies: AgentDependencies,
+  run: (baseUrl: string) => Promise<void>,
+): Promise<void> {
+  const app = express();
+  app.use(express.json());
+  app.use('/api/agent', createAgentRouter(dependencies));
+  const server = app.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  try {
+    const address = server.address() as AddressInfo;
+    await run(`http://127.0.0.1:${address.port}`);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+}
+
+test('Agent route rejects missing project input before invoking provider dependencies', async () => {
+  await withAgentServer(createDependencies(), async (baseUrl) => {
+    const response = await fetch(`${baseUrl}/api/agent`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ message: 'Inspect this project', stream: false }),
+    });
+    const body = await response.json() as { error: string };
+
+    assert.equal(response.status, 400);
+    assert.equal(body.error, 'Either githubUrl or projectPath is required');
+  });
+});
+
+test('Agent route validates API keys through the injected repository', async () => {
+  const receivedKeys: string[] = [];
+  await withAgentServer(createDependencies({
+    platformMode: false,
+    apiKeys: {
+      validateApiKey: (apiKey) => {
+        receivedKeys.push(apiKey);
+        return undefined;
+      },
+    },
+  }), async (baseUrl) => {
+    const response = await fetch(`${baseUrl}/api/agent`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'x-api-key': 'invalid-key' },
+      body: JSON.stringify({ projectPath: '/workspace/project', message: 'Run' }),
+    });
+    assert.equal(response.status, 401);
+  });
+
+  assert.deepEqual(receivedKeys, ['invalid-key']);
+});
+
+test('Agent route rejects GitHub lookalike hosts before cloning', async () => {
+  await withAgentServer(createDependencies(), async (baseUrl) => {
+    const response = await fetch(`${baseUrl}/api/agent`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        githubUrl: 'https://github.com.evil.example/owner/repo',
+        message: 'Run',
+        stream: false,
+      }),
+    });
+    const body = await response.json() as { error: string };
+
+    assert.equal(response.status, 500);
+    assert.equal(body.error, 'Invalid GitHub URL');
+  });
+});
+
+test('GitHub cloning keeps credentials out of arguments and remote URL', async () => {
+  const token = 'secret-token';
+  let cloneArgs: readonly string[] = [];
+  let cloneEnvironment: NodeJS.ProcessEnv | undefined;
+  const child = new EventEmitter() as EventEmitter & {
+    stdout: PassThrough;
+    stderr: PassThrough;
+  };
+  child.stdout = new PassThrough();
+  child.stderr = new PassThrough();
+
+  await withAgentServer(createDependencies({
+    fileSystem: {
+      access: async () => { throw new Error('missing'); },
+      mkdir: async () => undefined,
+    } as unknown as AgentDependencies['fileSystem'],
+    githubTokens: { getActiveGithubToken: () => token },
+    spawnProcess: ((_command: string, args: readonly string[], options: { env?: NodeJS.ProcessEnv }) => {
+      cloneArgs = args;
+      cloneEnvironment = options.env;
+      process.nextTick(() => child.emit('error', new Error('expected test failure')));
+      return child;
+    }) as unknown as AgentDependencies['spawnProcess'],
+  }), async (baseUrl) => {
+    const response = await fetch(`${baseUrl}/api/agent`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        githubUrl: 'https://github.com/owner/repo.git',
+        message: 'Run',
+        stream: false,
+      }),
+    });
+    assert.equal(response.status, 500);
+  });
+
+  assert.deepEqual(cloneArgs.slice(0, 5), [
+    'clone', '--depth', '1', '--', 'https://github.com/owner/repo.git',
+  ]);
+  assert.equal(cloneArgs.length, 6);
+  assert.equal(cloneArgs.join(' ').includes(token), false);
+  assert.equal(cloneEnvironment?.CLOUDCLI_GITHUB_TOKEN, token);
+  assert.equal(cloneEnvironment?.GIT_CONFIG_KEY_0, 'credential.helper');
+  assert.equal(cloneEnvironment?.GIT_CONFIG_VALUE_0, '');
+  assert.equal(cloneEnvironment?.GIT_CONFIG_KEY_1, 'credential.helper');
+});
+
+test('Agent route reuses a matching checkout without cloning or deleting it', async () => {
+  const spawnedArguments: string[][] = [];
+  const removedPaths: string[] = [];
+  const spawnProcess = ((_command: string, args: readonly string[]) => {
+    spawnedArguments.push([...args]);
+    const child = new EventEmitter() as EventEmitter & {
+      stdout: PassThrough;
+      stderr: PassThrough;
+    };
+    child.stdout = new PassThrough();
+    child.stderr = new PassThrough();
+    process.nextTick(() => {
+      child.stdout.end('https://github.com/owner/repo.git\n');
+      child.emit('close', 0);
+    });
+    return child;
+  }) as unknown as AgentDependencies['spawnProcess'];
+
+  await withAgentServer(createDependencies({
+    fileSystem: {
+      access: async () => undefined,
+      rm: async (targetPath: string) => { removedPaths.push(targetPath); },
+    } as unknown as AgentDependencies['fileSystem'],
+    spawnProcess,
+    models: {
+      getProviderModels: async () => ({ models: { DEFAULT: 'default-model' } }),
+    } as unknown as AgentDependencies['models'],
+    queryClaude: (async () => undefined) as AgentDependencies['queryClaude'],
+  }), async (baseUrl) => {
+    const response = await fetch(`${baseUrl}/api/agent`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        githubUrl: 'https://github.com/owner/repo.git',
+        projectPath: '/home/test/.claude/external-projects/existing',
+        message: 'Run',
+        stream: false,
+        cleanup: true,
+      }),
+    });
+    assert.equal(response.status, 200);
+  });
+
+  assert.deepEqual(spawnedArguments, [['config', '--get', 'remote.origin.url']]);
+  assert.deepEqual(removedPaths, []);
+});

package/server/modules/assets/assets.routes.ts

@@ -1,14 +1,12 @@
-import fsSync, { promises as fs } from 'node:fs';
-
 import express from 'express';
-import mime from 'mime-types';
 import multer from 'multer';
 
 import {
+  buildStoredAttachmentRecords,
   buildStoredImageRecords,
   ensureImageAssetsDir,
   isAllowedImageMimeType,
-  resolveImageAssetFile,
+  openStoredAttachmentAsset,
 } from '@/modules/assets/services/image-assets.service.js';
 
 const router = express.Router();
@@ -43,6 +41,14 @@ const upload = multer({
   },
 });
 
+const attachmentUpload = multer({
+  storage,
+  limits: {
+    fileSize: 10 * 1024 * 1024,
+    files: 10,
+  },
+});
+
 /**
  * Stores chat image attachments in the global `~/.cloudcli/assets` folder and
  * returns their absolute paths for use in provider prompts and chat history.
@@ -63,36 +69,52 @@ router.post('/images', (req, res) => {
   });
 });
 
+/**
+ * Stores provider-neutral chat attachments. Files of any MIME type are
+ * accepted because providers inspect them as data through their file-reading
+ * tools; uploads are capped at 10 files and 10MB per file.
+ */
+router.post('/files', (req, res) => {
+  attachmentUpload.array('files', 10)(req, res, (err: unknown) => {
+    if (err) {
+      const message = err instanceof Error ? err.message : 'Upload failed';
+      return res.status(400).json({ error: message });
+    }
+
+    const files = Array.isArray(req.files) ? req.files : [];
+    if (files.length === 0) {
+      return res.status(400).json({ error: 'No files provided' });
+    }
+
+    res.json({ attachments: buildStoredAttachmentRecords(files) });
+  });
+});
+
 /**
  * Serves one stored image asset by filename. Only files directly inside the
  * global assets folder are reachable; traversal attempts resolve to null.
  */
 router.get('/images/:filename', async (req, res) => {
-  const resolved = resolveImageAssetFile(req.params.filename);
-  if (!resolved) {
+  const asset = await openStoredAttachmentAsset(req.params.filename);
+  if (asset.status === 'invalid') {
     return res.status(400).json({ error: 'Invalid asset filename' });
   }
-
-  try {
-    await fs.access(resolved);
-  } catch {
+  if (asset.status === 'missing') {
     return res.status(404).json({ error: 'Asset not found' });
   }
 
-  const contentType = mime.lookup(resolved) || 'application/octet-stream';
-  res.setHeader('Content-Type', contentType);
+  res.setHeader('Content-Type', asset.contentType);
   // Stored-XSS hardening: never let the browser sniff a different type, and
   // force SVGs (which can carry scripts when rendered as a document) to
   // download instead of rendering inline. The chat UI is unaffected — it
   // fetches assets as blobs and shows them through <img>, where SVG scripts
   // never execute.
   res.setHeader('X-Content-Type-Options', 'nosniff');
-  if (contentType === 'image/svg+xml') {
+  if (asset.contentType === 'image/svg+xml') {
     res.setHeader('Content-Disposition', 'attachment');
   }
-  const fileStream = fsSync.createReadStream(resolved);
-  fileStream.pipe(res);
-  fileStream.on('error', (error) => {
+  asset.stream.pipe(res);
+  asset.stream.on('error', (error) => {
     console.error('Error streaming image asset:', error);
     if (!res.headersSent) {
       res.status(500).json({ error: 'Error reading asset' });
@@ -100,4 +122,29 @@ router.get('/images/:filename', async (req, res) => {
   });
 });
 
+/**
+ * Downloads one stored non-image attachment. Content-Disposition prevents
+ * uploaded HTML or other active formats from rendering in the application.
+ */
+router.get('/files/:filename', async (req, res) => {
+  const asset = await openStoredAttachmentAsset(req.params.filename);
+  if (asset.status === 'invalid') {
+    return res.status(400).json({ error: 'Invalid asset filename' });
+  }
+  if (asset.status === 'missing') {
+    return res.status(404).json({ error: 'Asset not found' });
+  }
+
+  res.setHeader('Content-Type', asset.contentType);
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('Content-Disposition', `attachment; filename="${req.params.filename.replace(/["\r\n]/g, '_')}"`);
+  asset.stream.pipe(res);
+  asset.stream.on('error', (error) => {
+    console.error('Error streaming attachment asset:', error);
+    if (!res.headersSent) {
+      res.status(500).json({ error: 'Error reading asset' });
+    }
+  });
+});
+
 export default router;

package/server/modules/assets/index.ts

@@ -1,3 +1,3 @@
-// Express router mounted at /api/assets by server/index.js (upload + serving
-// of chat image attachments stored in the global ~/.cloudcli/assets folder).
+// Express router mounted at /api/assets by server/index.ts for uploading and
+// serving chat attachments stored in the global ~/.cloudcli/assets folder.
 export { default as assetsRoutes } from './assets.routes.js';

package/server/modules/assets/services/image-assets.service.ts

@@ -1,6 +1,8 @@
-import { promises as fs } from 'node:fs';
+import fsSync, { promises as fs } from 'node:fs';
 import path from 'node:path';
 
+import mime from 'mime-types';
+
 import { getGlobalImageAssetsDir, toPosixPath } from '@/shared/image-attachments.js';
 
 /**
@@ -33,6 +35,8 @@ type UploadedImageFile = {
   mimetype: string;
 };
 
+type UploadedAttachmentFile = UploadedImageFile;
+
 /** Returns whether one uploaded mime type may be stored as a chat image asset. */
 export function isAllowedImageMimeType(mimeType: string): boolean {
   return ALLOWED_IMAGE_MIME_TYPES.has(mimeType);
@@ -60,6 +64,15 @@ export function buildStoredImageRecords(files: UploadedImageFile[]): StoredImage
   }));
 }
 
+/**
+ * Maps multer-stored files to provider-neutral attachment records for the
+ * assets route. The shared storage format intentionally matches image records
+ * so one uploaded file can move through queueing and provider dispatch.
+ */
+export function buildStoredAttachmentRecords(files: UploadedAttachmentFile[]): StoredImageAsset[] {
+  return buildStoredImageRecords(files);
+}
+
 /**
  * Resolves one asset filename to its absolute path inside the global assets
  * folder, or null when the name is empty, contains path separators/traversal,
@@ -80,3 +93,35 @@ export function resolveImageAssetFile(filename: string): string | null {
 
   return resolved;
 }
+
+/**
+ * Resolves a general chat attachment for the assets serving route. It shares
+ * the image resolver's strict direct-child containment boundary.
+ */
+export function resolveAttachmentAssetFile(filename: string): string | null {
+  return resolveImageAssetFile(filename);
+}
+
+/**
+ * Opens one stored chat asset for the assets route without exposing arbitrary
+ * filesystem reads. The route translates the lookup status and streams the
+ * returned direct-child file to the authenticated client.
+ */
+export async function openStoredAttachmentAsset(filename: string) {
+  const resolved = resolveAttachmentAssetFile(filename);
+  if (!resolved) {
+    return { status: 'invalid' as const };
+  }
+
+  try {
+    await fs.access(resolved);
+  } catch {
+    return { status: 'missing' as const };
+  }
+
+  return {
+    status: 'found' as const,
+    contentType: mime.lookup(resolved) || 'application/octet-stream',
+    stream: fsSync.createReadStream(resolved),
+  };
+}

package/server/modules/assets/tests/image-assets.service.test.ts

@@ -4,8 +4,10 @@ import path from 'node:path';
 import test from 'node:test';
 
 import {
+  buildStoredAttachmentRecords,
   buildStoredImageRecords,
   isAllowedImageMimeType,
+  resolveAttachmentAssetFile,
   resolveImageAssetFile,
 } from '@/modules/assets/services/image-assets.service.js';
 
@@ -30,6 +32,24 @@ test('buildStoredImageRecords returns absolute posix paths in the assets dir', (
   assert.equal(records[0].path, `${ASSETS_DIR.replace(/\\/g, '/')}/123-456-shot.png`);
 });
 
+test('buildStoredAttachmentRecords preserves metadata for non-image files', () => {
+  const records = buildStoredAttachmentRecords([
+    {
+      originalname: 'requirements.pdf',
+      filename: '123-456-requirements.pdf',
+      size: 2048,
+      mimetype: 'application/pdf',
+    },
+  ]);
+
+  assert.deepEqual(records[0], {
+    name: 'requirements.pdf',
+    path: `${ASSETS_DIR.replace(/\\/g, '/')}/123-456-requirements.pdf`,
+    size: 2048,
+    mimeType: 'application/pdf',
+  });
+});
+
 test('resolveImageAssetFile resolves plain filenames inside the assets dir', () => {
   const resolved = resolveImageAssetFile('123-shot.png');
   assert.equal(resolved, path.join(path.resolve(ASSETS_DIR), '123-shot.png'));
@@ -44,3 +64,11 @@ test('resolveImageAssetFile rejects traversal and separator attempts', () => {
   assert.equal(resolveImageAssetFile('sub\\dir.png'), null);
   assert.equal(resolveImageAssetFile('a..b/../c.png'), null);
 });
+
+test('resolveAttachmentAssetFile uses the same direct-child boundary', () => {
+  assert.equal(
+    resolveAttachmentAssetFile('123-notes.txt'),
+    path.join(path.resolve(ASSETS_DIR), '123-notes.txt'),
+  );
+  assert.equal(resolveAttachmentAssetFile('../notes.txt'), null);
+});

package/server/{middleware/auth.js → modules/auth/auth.middleware.ts}

@@ -1,6 +1,9 @@
+// @ts-nocheck -- JWT request augmentation is narrowed by Auth route contracts.
 import jwt from 'jsonwebtoken';
-import { userDb, appConfigDb } from '../modules/database/index.js';
-import { IS_PLATFORM } from '../constants/config.js';
+
+import { userDb, appConfigDb } from '../database/index.js';
+
+const IS_PLATFORM = process.env.VITE_IS_PLATFORM === 'true';
 
 // Use env var if set, otherwise auto-generate a unique secret per installation
 const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
@@ -46,7 +49,11 @@ const authenticateToken = async (req, res, next) => {
   }
 
   if (!token) {
-    return res.status(401).json({ error: 'Access denied. No token provided.' });
+    res.setHeader('X-Auth-Error', 'invalid-token');
+    return res.status(401).json({
+      error: 'Access denied. No token provided.',
+      code: 'AUTH_TOKEN_INVALID',
+    });
   }
 
   try {
@@ -55,7 +62,11 @@ const authenticateToken = async (req, res, next) => {
     // Verify user still exists and is active
     const user = userDb.getUserById(decoded.userId);
     if (!user) {
-      return res.status(401).json({ error: 'Invalid token. User not found.' });
+      res.setHeader('X-Auth-Error', 'invalid-token');
+      return res.status(401).json({
+        error: 'Invalid token. User not found.',
+        code: 'AUTH_TOKEN_INVALID',
+      });
     }
 
     // Auto-refresh: if token is past halfway through its lifetime, issue a new one
@@ -71,8 +82,23 @@ const authenticateToken = async (req, res, next) => {
     req.user = user;
     next();
   } catch (error) {
-    console.error('Token verification error:', error);
-    return res.status(403).json({ error: 'Invalid token' });
+    if (error instanceof jwt.TokenExpiredError) {
+      res.setHeader('X-Auth-Error', 'session-expired');
+      return res.status(401).json({
+        error: 'Session expired. Please log in again.',
+        code: 'AUTH_TOKEN_EXPIRED',
+      });
+    }
+
+    console.warn(
+      'Token verification failed:',
+      error instanceof Error ? error.message : String(error),
+    );
+    res.setHeader('X-Auth-Error', 'invalid-token');
+    return res.status(401).json({
+      error: 'Invalid token',
+      code: 'AUTH_TOKEN_INVALID',
+    });
   }
 };
 
@@ -118,7 +144,12 @@ const authenticateWebSocket = (token) => {
     }
     return { userId: user.id, username: user.username };
   } catch (error) {
-    console.error('WebSocket token verification error:', error);
+    if (!(error instanceof jwt.TokenExpiredError)) {
+      console.warn(
+        'WebSocket token verification failed:',
+        error instanceof Error ? error.message : String(error),
+      );
+    }
     return null;
   }
 };

package/server/modules/auth/auth.module.ts

@@ -0,0 +1,38 @@
+import { createRequire } from 'node:module';
+
+import { getConnection, userDb } from '@/modules/database/index.js';
+
+import { authenticateToken, generateToken } from './auth.middleware.js';
+import { createAuthRouter } from './auth.routes.js';
+import { createAuthService } from './auth.service.js';
+
+type BcryptAdapter = {
+  hash(password: string, saltRounds: number): Promise<string>;
+  compare(password: string, passwordHash: string): Promise<boolean>;
+};
+
+// bcrypt does not ship TypeScript declarations in this project, so the
+// composition root narrows its CommonJS runtime surface before injecting it.
+const require = createRequire(import.meta.url);
+const bcrypt = require('bcrypt') as BcryptAdapter;
+const databaseConnection = getConnection();
+
+const authService = createAuthService({
+  users: {
+    hasUsers: () => userDb.hasUsers(),
+    createUser: (username, passwordHash) => userDb.createUser(username, passwordHash),
+    getUserByUsername: (username) => userDb.getUserByUsername(username),
+    updateLastLogin: (userId) => userDb.updateLastLogin(userId),
+  },
+  transaction: {
+    begin: () => databaseConnection.prepare('BEGIN').run(),
+    commit: () => databaseConnection.prepare('COMMIT').run(),
+    rollback: () => databaseConnection.prepare('ROLLBACK').run(),
+  },
+  hashPassword: (password) => bcrypt.hash(password, 12),
+  comparePassword: (password, passwordHash) => bcrypt.compare(password, passwordHash),
+  generateToken,
+});
+
+/** Auth router assembled for the server entrypoint. */
+export const authRoutes = createAuthRouter(authService, authenticateToken);

package/server/modules/auth/auth.routes.ts

@@ -0,0 +1,57 @@
+import express from 'express';
+import type { RequestHandler } from 'express';
+
+import type { createAuthService } from './auth.service.js';
+
+type AuthenticatedRequest = express.Request & { user?: unknown };
+
+/**
+ * Creates the Auth transport adapter. Handlers only parse request data and
+ * delegate authentication behavior to the injected application service.
+ */
+export function createAuthRouter(
+  service: ReturnType<typeof createAuthService>,
+  authenticateToken: RequestHandler,
+): express.Router {
+  const router = express.Router();
+
+  router.get('/status', (_req, res, next) => {
+    try {
+      res.json(service.getStatus());
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.post('/register', async (req, res, next) => {
+    try {
+      const body = req.body as { username?: unknown; password?: unknown };
+      res.json(await service.register(body.username, body.password));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.post('/login', async (req, res, next) => {
+    try {
+      const body = req.body as { username?: unknown; password?: unknown };
+      res.json(await service.login(body.username, body.password));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.get('/user', authenticateToken, (req, res) => {
+    res.json(service.getCurrentUser((req as AuthenticatedRequest).user));
+  });
+
+  router.post('/refresh', authenticateToken, (req, res) => {
+    res.json(service.refreshSession((req as AuthenticatedRequest).user));
+  });
+
+  router.post('/logout', authenticateToken, (_req, res) => {
+    res.json(service.logout());
+  });
+
+  return router;
+}