@cloudflare/sandbox 0.2.3 → 0.3.0

package/container_src/handler/file.ts

@@ -1,160 +1,116 @@
-import { spawn } from "node:child_process";
-import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
+import type { SessionManager } from "../isolation";
 import type {
     DeleteFileRequest,
+    ListFilesRequest,
     MkdirRequest,
     MoveFileRequest,
     ReadFileRequest,
     RenameFileRequest,
-    SessionData,
     WriteFileRequest
 } from "../types";
 
-function executeMkdir(
-    sessions: Map<string, SessionData>,
-    path: string,
-    recursive: boolean,
-    sessionId?: string
-): Promise<{
-    success: boolean;
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-}> {
-    return new Promise((resolve, reject) => {
-        const args = `${recursive ? "-p " : ""} ${path}`;
-        const mkdirChild = spawn(`mkdir ${args}`, {
-            shell: true,
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-
-        // Store the process reference for cleanup if sessionId is provided
-        if (sessionId && sessions.has(sessionId)) {
-            const session = sessions.get(sessionId)!;
-            session.activeProcess = mkdirChild;
+// Common path validation patterns
+const DANGEROUS_PATH_PATTERNS = [
+    /^\/$/, // Root directory
+    /^\/etc/, // System directories
+    /^\/var/, // System directories
+    /^\/usr/, // System directories
+    /^\/bin/, // System directories
+    /^\/sbin/, // System directories
+    /^\/boot/, // System directories
+    /^\/dev/, // System directories
+    /^\/proc/, // System directories
+    /^\/sys/, // System directories
+    /^\/tmp\/\.\./, // Path traversal attempts
+    /\.\./, // Path traversal attempts
+];
+
+// Path validation utility
+function validatePath(...paths: string[]): string | null {
+    for (const path of paths) {
+        if (!path || typeof path !== "string") {
+            return "Path is required and must be a string";
         }
+        
+        if (DANGEROUS_PATH_PATTERNS.some((pattern) => pattern.test(path))) {
+            return "Dangerous path not allowed";
+        }
+    }
+    return null;
+}
 
-        let stdout = "";
-        let stderr = "";
-
-        mkdirChild.stdout?.on("data", (data) => {
-            stdout += data.toString();
-        });
-
-        mkdirChild.stderr?.on("data", (data) => {
-            stderr += data.toString();
-        });
-
-        mkdirChild.on("close", (code) => {
-            // Clear the active process reference
-            if (sessionId && sessions.has(sessionId)) {
-                const session = sessions.get(sessionId)!;
-                session.activeProcess = null;
-            }
-
-            if (code === 0) {
-                console.log(`[Server] Directory created successfully: ${path}`);
-                resolve({
-                    exitCode: code || 0,
-                    stderr,
-                    stdout,
-                    success: true,
-                });
-            } else {
-                console.error(
-                    `[Server] Failed to create directory: ${path}, Exit code: ${code}`
-                );
-                resolve({
-                    exitCode: code || 1,
-                    stderr,
-                    stdout,
-                    success: false,
-                });
-            }
-        });
-
-        mkdirChild.on("error", (error) => {
-            // Clear the active process reference
-            if (sessionId && sessions.has(sessionId)) {
-                const session = sessions.get(sessionId)!;
-                session.activeProcess = null;
-            }
+// Common error response utility
+function createPathErrorResponse(
+    error: string,
+    corsHeaders: Record<string, string>
+): Response {
+    return new Response(
+        JSON.stringify({ error }),
+        {
+            headers: {
+                "Content-Type": "application/json",
+                ...corsHeaders,
+            },
+            status: 400,
+        }
+    );
+}
 
-            console.error(`[Server] Error creating directory: ${path}`, error);
-            reject(error);
-        });
-    });
+// Common server error response utility
+function createServerErrorResponse(
+    operation: string,
+    error: unknown,
+    corsHeaders: Record<string, string>
+): Response {
+    console.error(`[Server] Error in ${operation}:`, error);
+    return new Response(
+        JSON.stringify({
+            error: `Failed to ${operation.replace('handle', '').replace('Request', '').toLowerCase().replace('file', ' file')}`,
+            message: error instanceof Error ? error.message : "Unknown error",
+        }),
+        {
+            headers: {
+                "Content-Type": "application/json",
+                ...corsHeaders,
+            },
+            status: 500,
+        }
+    );
 }
 
 export async function handleMkdirRequest(
-    sessions: Map<string, SessionData>,
     req: Request,
-    corsHeaders: Record<string, string>
+    corsHeaders: Record<string, string>,
+    sessionManager: SessionManager
 ): Promise<Response> {
     try {
         const body = (await req.json()) as MkdirRequest;
         const { path, recursive = false, sessionId } = body;
 
-        if (!path || typeof path !== "string") {
-            return new Response(
-                JSON.stringify({
-                    error: "Path is required and must be a string",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
+        // Validate path
+        const pathError = validatePath(path);
+        if (pathError) {
+            return createPathErrorResponse(pathError, corsHeaders);
         }
 
-        // Basic safety check - prevent dangerous paths
-        const dangerousPatterns = [
-            /^\/$/, // Root directory
-            /^\/etc/, // System directories
-            /^\/var/, // System directories
-            /^\/usr/, // System directories
-            /^\/bin/, // System directories
-            /^\/sbin/, // System directories
-            /^\/boot/, // System directories
-            /^\/dev/, // System directories
-            /^\/proc/, // System directories
-            /^\/sys/, // System directories
-            /^\/tmp\/\.\./, // Path traversal attempts
-            /\.\./, // Path traversal attempts
-        ];
-
-        if (dangerousPatterns.some((pattern) => pattern.test(path))) {
-            return new Response(
-                JSON.stringify({
-                    error: "Dangerous path not allowed",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
-        }
+        console.log(`[Server] Creating directory: ${path} (recursive: ${recursive})${sessionId ? ` in session: ${sessionId}` : ''}`);
 
-        console.log(
-            `[Server] Creating directory: ${path} (recursive: ${recursive})`
-        );
-
-        const result = await executeMkdir(sessions, path, recursive, sessionId);
+        // Use specific session if provided, otherwise default session
+        const result = sessionId
+            ? await sessionManager.getSession(sessionId)?.mkdirOperation(path, recursive)
+            : await sessionManager.mkdir(path, recursive);
+        
+        if (!result) {
+            return createServerErrorResponse("handleMkdirRequest", new Error(`Session '${sessionId}' not found`), corsHeaders);
+        }
 
         return new Response(
             JSON.stringify({
                 exitCode: result.exitCode,
                 path,
                 recursive,
-                stderr: result.stderr,
-                stdout: result.stdout,
+                stderr: "",
+                stdout: "",
                 success: result.success,
                 timestamp: new Date().toISOString(),
             }),
@@ -166,119 +122,35 @@ export async function handleMkdirRequest(
             }
         );
     } catch (error) {
-        console.error("[Server] Error in handleMkdirRequest:", error);
-        return new Response(
-            JSON.stringify({
-                error: "Failed to create directory",
-                message: error instanceof Error ? error.message : "Unknown error",
-            }),
-            {
-                headers: {
-                    "Content-Type": "application/json",
-                    ...corsHeaders,
-                },
-                status: 500,
-            }
-        );
+        return createServerErrorResponse("handleMkdirRequest", error, corsHeaders);
     }
 }
 
-
-function executeWriteFile(
-    path: string,
-    content: string,
-    encoding: string,
-    sessionId?: string
-): Promise<{
-    success: boolean;
-    exitCode: number;
-}> {
-    return new Promise((resolve, reject) => {
-        (async () => {
-            try {
-                // Ensure the directory exists
-                const dir = dirname(path);
-                if (dir !== ".") {
-                    await mkdir(dir, { recursive: true });
-                }
-
-                // Write the file
-                await writeFile(path, content, {
-                    encoding: encoding as BufferEncoding,
-                });
-
-                console.log(`[Server] File written successfully: ${path}`);
-                resolve({
-                    exitCode: 0,
-                    success: true,
-                });
-            } catch (error) {
-                console.error(`[Server] Error writing file: ${path}`, error);
-                reject(error);
-            }
-        })();
-    });
-}
-
 export async function handleWriteFileRequest(
     req: Request,
-    corsHeaders: Record<string, string>
+    corsHeaders: Record<string, string>,
+    sessionManager: SessionManager
 ): Promise<Response> {
     try {
         const body = (await req.json()) as WriteFileRequest;
         const { path, content, encoding = "utf-8", sessionId } = body;
 
-        if (!path || typeof path !== "string") {
-            return new Response(
-                JSON.stringify({
-                    error: "Path is required and must be a string",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
+        // Validate path
+        const pathError = validatePath(path);
+        if (pathError) {
+            return createPathErrorResponse(pathError, corsHeaders);
         }
 
-        // Basic safety check - prevent dangerous paths
-        const dangerousPatterns = [
-            /^\/$/, // Root directory
-            /^\/etc/, // System directories
-            /^\/var/, // System directories
-            /^\/usr/, // System directories
-            /^\/bin/, // System directories
-            /^\/sbin/, // System directories
-            /^\/boot/, // System directories
-            /^\/dev/, // System directories
-            /^\/proc/, // System directories
-            /^\/sys/, // System directories
-            /^\/tmp\/\.\./, // Path traversal attempts
-            /\.\./, // Path traversal attempts
-        ];
-
-        if (dangerousPatterns.some((pattern) => pattern.test(path))) {
-            return new Response(
-                JSON.stringify({
-                    error: "Dangerous path not allowed",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
-        }
+        console.log(`[Server] Writing file: ${path} (content length: ${content.length})${sessionId ? ` in session: ${sessionId}` : ''}`);
 
-        console.log(
-            `[Server] Writing file: ${path} (content length: ${content.length})`
-        );
-
-        const result = await executeWriteFile(path, content, encoding, sessionId);
+        // Use specific session if provided, otherwise default session
+        const result = sessionId
+            ? await sessionManager.getSession(sessionId)?.writeFileOperation(path, content, encoding)
+            : await sessionManager.writeFile(path, content, encoding);
+        
+        if (!result) {
+            return createServerErrorResponse("handleWriteFileRequest", new Error(`Session '${sessionId}' not found`), corsHeaders);
+        }
 
         return new Response(
             JSON.stringify({
@@ -295,112 +167,35 @@ export async function handleWriteFileRequest(
             }
         );
     } catch (error) {
-        console.error("[Server] Error in handleWriteFileRequest:", error);
-        return new Response(
-            JSON.stringify({
-                error: "Failed to write file",
-                message: error instanceof Error ? error.message : "Unknown error",
-            }),
-            {
-                headers: {
-                    "Content-Type": "application/json",
-                    ...corsHeaders,
-                },
-                status: 500,
-            }
-        );
+        return createServerErrorResponse("handleWriteFileRequest", error, corsHeaders);
     }
 }
 
-
-function executeReadFile(
-    path: string,
-    encoding: string,
-    sessionId?: string
-): Promise<{
-    success: boolean;
-    exitCode: number;
-    content: string;
-}> {
-    return new Promise((resolve, reject) => {
-        (async () => {
-            try {
-                // Read the file
-                const content = await readFile(path, {
-                    encoding: encoding as BufferEncoding,
-                });
-
-                console.log(`[Server] File read successfully: ${path}`);
-                resolve({
-                    content,
-                    exitCode: 0,
-                    success: true,
-                });
-            } catch (error) {
-                console.error(`[Server] Error reading file: ${path}`, error);
-                reject(error);
-            }
-        })();
-    });
-}
-
 export async function handleReadFileRequest(
     req: Request,
-    corsHeaders: Record<string, string>
+    corsHeaders: Record<string, string>,
+    sessionManager: SessionManager
 ): Promise<Response> {
     try {
         const body = (await req.json()) as ReadFileRequest;
         const { path, encoding = "utf-8", sessionId } = body;
 
-        if (!path || typeof path !== "string") {
-            return new Response(
-                JSON.stringify({
-                    error: "Path is required and must be a string",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
-        }
-
-        // Basic safety check - prevent dangerous paths
-        const dangerousPatterns = [
-            /^\/$/, // Root directory
-            /^\/etc/, // System directories
-            /^\/var/, // System directories
-            /^\/usr/, // System directories
-            /^\/bin/, // System directories
-            /^\/sbin/, // System directories
-            /^\/boot/, // System directories
-            /^\/dev/, // System directories
-            /^\/proc/, // System directories
-            /^\/sys/, // System directories
-            /^\/tmp\/\.\./, // Path traversal attempts
-            /\.\./, // Path traversal attempts
-        ];
-
-        if (dangerousPatterns.some((pattern) => pattern.test(path))) {
-            return new Response(
-                JSON.stringify({
-                    error: "Dangerous path not allowed",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
+        // Validate path
+        const pathError = validatePath(path);
+        if (pathError) {
+            return createPathErrorResponse(pathError, corsHeaders);
         }
 
-        console.log(`[Server] Reading file: ${path}`);
+        console.log(`[Server] Reading file: ${path}${sessionId ? ` in session: ${sessionId}` : ''}`);
 
-        const result = await executeReadFile(path, encoding, sessionId);
+        // Use specific session if provided, otherwise default session
+        const result = sessionId
+            ? await sessionManager.getSession(sessionId)?.readFileOperation(path, encoding)
+            : await sessionManager.readFile(path, encoding);
+        
+        if (!result) {
+            return createServerErrorResponse("handleReadFileRequest", new Error(`Session '${sessionId}' not found`), corsHeaders);
+        }
 
         return new Response(
             JSON.stringify({
@@ -418,107 +213,35 @@ export async function handleReadFileRequest(
             }
         );
     } catch (error) {
-        console.error("[Server] Error in handleReadFileRequest:", error);
-        return new Response(
-            JSON.stringify({
-                error: "Failed to read file",
-                message: error instanceof Error ? error.message : "Unknown error",
-            }),
-            {
-                headers: {
-                    "Content-Type": "application/json",
-                    ...corsHeaders,
-                },
-                status: 500,
-            }
-        );
+        return createServerErrorResponse("handleReadFileRequest", error, corsHeaders);
     }
 }
 
-
-function executeDeleteFile(
-  path: string,
-  sessionId?: string
-): Promise<{
-  success: boolean;
-  exitCode: number;
-}> {
-  return new Promise((resolve, reject) => {
-    (async () => {
-      try {
-        // Delete the file
-        await unlink(path);
-
-        console.log(`[Server] File deleted successfully: ${path}`);
-        resolve({
-          exitCode: 0,
-          success: true,
-        });
-      } catch (error) {
-        console.error(`[Server] Error deleting file: ${path}`, error);
-        reject(error);
-      }
-    })();
-  });
-}
-
 export async function handleDeleteFileRequest(
     req: Request,
-    corsHeaders: Record<string, string>
+    corsHeaders: Record<string, string>,
+    sessionManager: SessionManager
 ): Promise<Response> {
     try {
         const body = (await req.json()) as DeleteFileRequest;
         const { path, sessionId } = body;
 
-        if (!path || typeof path !== "string") {
-            return new Response(
-                JSON.stringify({
-                    error: "Path is required and must be a string",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
-        }
-
-        // Basic safety check - prevent dangerous paths
-        const dangerousPatterns = [
-            /^\/$/, // Root directory
-            /^\/etc/, // System directories
-            /^\/var/, // System directories
-            /^\/usr/, // System directories
-            /^\/bin/, // System directories
-            /^\/sbin/, // System directories
-            /^\/boot/, // System directories
-            /^\/dev/, // System directories
-            /^\/proc/, // System directories
-            /^\/sys/, // System directories
-            /^\/tmp\/\.\./, // Path traversal attempts
-            /\.\./, // Path traversal attempts
-        ];
-
-        if (dangerousPatterns.some((pattern) => pattern.test(path))) {
-            return new Response(
-                JSON.stringify({
-                    error: "Dangerous path not allowed",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
+        // Validate path
+        const pathError = validatePath(path);
+        if (pathError) {
+            return createPathErrorResponse(pathError, corsHeaders);
         }
 
-        console.log(`[Server] Deleting file: ${path}`);
+        console.log(`[Server] Deleting file: ${path}${sessionId ? ` in session: ${sessionId}` : ''}`);
 
-        const result = await executeDeleteFile(path, sessionId);
+        // Use specific session if provided, otherwise default session
+        const result = sessionId
+            ? await sessionManager.getSession(sessionId)?.deleteFileOperation(path)
+            : await sessionManager.deleteFile(path);
+        
+        if (!result) {
+            return createServerErrorResponse("handleDeleteFileRequest", new Error(`Session '${sessionId}' not found`), corsHeaders);
+        }
 
         return new Response(
             JSON.stringify({
@@ -535,133 +258,36 @@ export async function handleDeleteFileRequest(
             }
         );
     } catch (error) {
-        console.error("[Server] Error in handleDeleteFileRequest:", error);
-        return new Response(
-            JSON.stringify({
-                error: "Failed to delete file",
-                message: error instanceof Error ? error.message : "Unknown error",
-            }),
-            {
-                headers: {
-                    "Content-Type": "application/json",
-                    ...corsHeaders,
-                },
-                status: 500,
-            }
-        );
+        return createServerErrorResponse("handleDeleteFileRequest", error, corsHeaders);
     }
 }
 
-
-function executeRenameFile(
-  oldPath: string,
-  newPath: string,
-  sessionId?: string
-): Promise<{
-  success: boolean;
-  exitCode: number;
-}> {
-  return new Promise((resolve, reject) => {
-    (async () => {
-      try {
-        // Rename the file
-        await rename(oldPath, newPath);
-
-        console.log(
-          `[Server] File renamed successfully: ${oldPath} -> ${newPath}`
-        );
-        resolve({
-          exitCode: 0,
-          success: true,
-        });
-      } catch (error) {
-        console.error(
-          `[Server] Error renaming file: ${oldPath} -> ${newPath}`,
-          error
-        );
-        reject(error);
-      }
-    })();
-  });
-}
-
 export async function handleRenameFileRequest(
     req: Request,
-    corsHeaders: Record<string, string>
+    corsHeaders: Record<string, string>,
+    sessionManager: SessionManager
 ): Promise<Response> {
     try {
         const body = (await req.json()) as RenameFileRequest;
         const { oldPath, newPath, sessionId } = body;
 
-        if (!oldPath || typeof oldPath !== "string") {
-            return new Response(
-                JSON.stringify({
-                    error: "Old path is required and must be a string",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
+        // Validate paths
+        const pathError = validatePath(oldPath, newPath);
+        if (pathError) {
+            return createPathErrorResponse(pathError, corsHeaders);
         }
 
-        if (!newPath || typeof newPath !== "string") {
-            return new Response(
-                JSON.stringify({
-                    error: "New path is required and must be a string",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
-        }
+        console.log(`[Server] Renaming file: ${oldPath} -> ${newPath}${sessionId ? ` in session: ${sessionId}` : ''}`);
 
-        // Basic safety check - prevent dangerous paths
-        const dangerousPatterns = [
-            /^\/$/, // Root directory
-            /^\/etc/, // System directories
-            /^\/var/, // System directories
-            /^\/usr/, // System directories
-            /^\/bin/, // System directories
-            /^\/sbin/, // System directories
-            /^\/boot/, // System directories
-            /^\/dev/, // System directories
-            /^\/proc/, // System directories
-            /^\/sys/, // System directories
-            /^\/tmp\/\.\./, // Path traversal attempts
-            /\.\./, // Path traversal attempts
-        ];
-
-        if (
-            dangerousPatterns.some(
-                (pattern) => pattern.test(oldPath) || pattern.test(newPath)
-            )
-        ) {
-            return new Response(
-                JSON.stringify({
-                    error: "Dangerous path not allowed",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
+        // Use specific session if provided, otherwise default session
+        const result = sessionId
+            ? await sessionManager.getSession(sessionId)?.renameFileOperation(oldPath, newPath)
+            : await sessionManager.renameFile(oldPath, newPath);
+        
+        if (!result) {
+            return createServerErrorResponse("handleRenameFileRequest", new Error(`Session '${sessionId}' not found`), corsHeaders);
         }
 
-        console.log(`[Server] Renaming file: ${oldPath} -> ${newPath}`);
-
-        const result = await executeRenameFile(oldPath, newPath, sessionId);
-
         return new Response(
             JSON.stringify({
                 exitCode: result.exitCode,
@@ -678,137 +304,36 @@ export async function handleRenameFileRequest(
             }
         );
     } catch (error) {
-        console.error("[Server] Error in handleRenameFileRequest:", error);
-        return new Response(
-            JSON.stringify({
-                error: "Failed to rename file",
-                message: error instanceof Error ? error.message : "Unknown error",
-            }),
-            {
-                headers: {
-                    "Content-Type": "application/json",
-                    ...corsHeaders,
-                },
-                status: 500,
-            }
-        );
+        return createServerErrorResponse("handleRenameFileRequest", error, corsHeaders);
     }
 }
 
-
-function executeMoveFile(
-  sourcePath: string,
-  destinationPath: string,
-  sessionId?: string
-): Promise<{
-  success: boolean;
-  exitCode: number;
-}> {
-  return new Promise((resolve, reject) => {
-    (async () => {
-      try {
-        // Move the file
-        await rename(sourcePath, destinationPath);
-
-        console.log(
-          `[Server] File moved successfully: ${sourcePath} -> ${destinationPath}`
-        );
-        resolve({
-          exitCode: 0,
-          success: true,
-        });
-      } catch (error) {
-        console.error(
-          `[Server] Error moving file: ${sourcePath} -> ${destinationPath}`,
-          error
-        );
-        reject(error);
-      }
-    })();
-  });
-}
-
 export async function handleMoveFileRequest(
     req: Request,
-    corsHeaders: Record<string, string>
+    corsHeaders: Record<string, string>,
+    sessionManager: SessionManager
 ): Promise<Response> {
     try {
         const body = (await req.json()) as MoveFileRequest;
         const { sourcePath, destinationPath, sessionId } = body;
 
-        if (!sourcePath || typeof sourcePath !== "string") {
-            return new Response(
-                JSON.stringify({
-                    error: "Source path is required and must be a string",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
+        // Validate paths
+        const pathError = validatePath(sourcePath, destinationPath);
+        if (pathError) {
+            return createPathErrorResponse(pathError, corsHeaders);
         }
 
-        if (!destinationPath || typeof destinationPath !== "string") {
-            return new Response(
-                JSON.stringify({
-                    error: "Destination path is required and must be a string",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
-        }
+        console.log(`[Server] Moving file: ${sourcePath} -> ${destinationPath}${sessionId ? ` in session: ${sessionId}` : ''}`);
 
-        // Basic safety check - prevent dangerous paths
-        const dangerousPatterns = [
-            /^\/$/, // Root directory
-            /^\/etc/, // System directories
-            /^\/var/, // System directories
-            /^\/usr/, // System directories
-            /^\/bin/, // System directories
-            /^\/sbin/, // System directories
-            /^\/boot/, // System directories
-            /^\/dev/, // System directories
-            /^\/proc/, // System directories
-            /^\/sys/, // System directories
-            /^\/tmp\/\.\./, // Path traversal attempts
-            /\.\./, // Path traversal attempts
-        ];
-
-        if (
-            dangerousPatterns.some(
-                (pattern) => pattern.test(sourcePath) || pattern.test(destinationPath)
-            )
-        ) {
-            return new Response(
-                JSON.stringify({
-                    error: "Dangerous path not allowed",
-                }),
-                {
-                    headers: {
-                        "Content-Type": "application/json",
-                        ...corsHeaders,
-                    },
-                    status: 400,
-                }
-            );
+        // Use specific session if provided, otherwise default session
+        const result = sessionId
+            ? await sessionManager.getSession(sessionId)?.moveFileOperation(sourcePath, destinationPath)
+            : await sessionManager.moveFile(sourcePath, destinationPath);
+        
+        if (!result) {
+            return createServerErrorResponse("handleMoveFileRequest", new Error(`Session '${sessionId}' not found`), corsHeaders);
         }
 
-        console.log(`[Server] Moving file: ${sourcePath} -> ${destinationPath}`);
-
-        const result = await executeMoveFile(
-            sourcePath,
-            destinationPath,
-            sessionId
-        );
-
         return new Response(
             JSON.stringify({
                 destinationPath,
@@ -825,20 +350,57 @@ export async function handleMoveFileRequest(
             }
         );
     } catch (error) {
-        console.error("[Server] Error in handleMoveFileRequest:", error);
+        return createServerErrorResponse("handleMoveFileRequest", error, corsHeaders);
+    }
+}
+
+export async function handleListFilesRequest(
+    req: Request,
+    corsHeaders: Record<string, string>,
+    sessionManager: SessionManager
+): Promise<Response> {
+    try {
+        const body = (await req.json()) as ListFilesRequest;
+        const { path, options, sessionId } = body;
+
+        // Validate path (note: listFiles allows root directory listing)
+        const pathError = validatePath(path);
+        if (pathError && pathError !== "Dangerous path not allowed") {
+            return createPathErrorResponse(pathError, corsHeaders);
+        }
+        
+        // For listFiles, we allow root directory but still check other dangerous patterns
+        if (path !== "/" && DANGEROUS_PATH_PATTERNS.slice(1).some((pattern) => pattern.test(path))) {
+            return createPathErrorResponse("Dangerous path not allowed", corsHeaders);
+        }
+
+        console.log(`[Server] Listing files in: ${path}${sessionId ? ` in session: ${sessionId}` : ''}`);
+
+        // Use specific session if provided, otherwise default session
+        const result = sessionId
+            ? await sessionManager.getSession(sessionId)?.listFilesOperation(path, options)
+            : await sessionManager.listFiles(path, options);
+        
+        if (!result) {
+            return createServerErrorResponse("handleListFilesRequest", new Error(`Session '${sessionId}' not found`), corsHeaders);
+        }
+
         return new Response(
             JSON.stringify({
-                error: "Failed to move file",
-                message: error instanceof Error ? error.message : "Unknown error",
+                exitCode: result.exitCode,
+                files: result.files,
+                path,
+                success: result.success,
+                timestamp: new Date().toISOString(),
             }),
             {
                 headers: {
                     "Content-Type": "application/json",
                     ...corsHeaders,
                 },
-                status: 500,
             }
         );
+    } catch (error) {
+        return createServerErrorResponse("handleListFilesRequest", error, corsHeaders);
     }
-}
-
+}