@danneillouven/remote-workspace 0.0.0-stage → 0.1.0

package/runtime/server/src/modules/terminal/terminal-session.js

@@ -0,0 +1,124 @@
+import { randomUUID } from 'node:crypto';
+import { OutputBuffer } from "./output-buffer.js";
+// Flow control: stop reading from the PTY while this many bytes are queued on
+// the WebSocket, and resume once the queue drains below the low-water mark.
+const HIGH_WATER_BYTES = 1024 * 1024;
+const LOW_WATER_BYTES = 256 * 1024;
+// A finished shell without a client is always reaped, even when running ones are kept forever.
+const EXITED_ORPHAN_TIMEOUT_MS = 10 * 60 * 1000;
+/**
+ * One remote shell. Its lifetime is independent of any WebSocket: clients
+ * attach and detach freely, output is kept in a bounded replay buffer, and a
+ * session with no client for `orphanTimeoutMs` (if set) is terminated.
+ */
+export class TerminalSession {
+    id = randomUUID();
+    createdAt = new Date();
+    workspaceId;
+    #pty;
+    #buffer;
+    #options;
+    #client = null;
+    #clientGeneration = 0;
+    #exit = null;
+    #orphanTimer = null;
+    #pendingBytes = 0;
+    #paused = false;
+    constructor(pty, options) {
+        this.#pty = pty;
+        this.#options = options;
+        this.workspaceId = options.workspaceId;
+        this.#buffer = new OutputBuffer(options.replayBufferBytes);
+        pty.onData((chunk) => this.#handleOutput(chunk));
+        pty.onExit((exit) => {
+            this.#exit = exit;
+            if (this.#client)
+                this.#client.sendExit(exit);
+            else
+                this.#startOrphanTimer();
+        });
+        this.#startOrphanTimer();
+    }
+    get status() {
+        return this.#exit ? 'exited' : 'running';
+    }
+    get exit() {
+        return this.#exit;
+    }
+    get attached() {
+        return this.#client !== null;
+    }
+    #handleOutput(chunk) {
+        this.#buffer.append(chunk);
+        const client = this.#client;
+        if (!client)
+            return;
+        const generation = this.#clientGeneration;
+        this.#pendingBytes += chunk.length;
+        client.sendOutput(chunk, () => {
+            if (generation !== this.#clientGeneration)
+                return;
+            this.#pendingBytes -= chunk.length;
+            if (this.#paused && this.#pendingBytes < LOW_WATER_BYTES)
+                this.#setPaused(false);
+        });
+        if (!this.#paused && this.#pendingBytes > HIGH_WATER_BYTES)
+            this.#setPaused(true);
+    }
+    #setPaused(paused) {
+        this.#paused = paused;
+        if (paused)
+            this.#pty.pause();
+        else
+            this.#pty.resume();
+    }
+    #startOrphanTimer() {
+        this.#clearOrphanTimer();
+        const timeout = this.#options.orphanTimeoutMs || (this.#exit ? EXITED_ORPHAN_TIMEOUT_MS : 0);
+        if (timeout <= 0)
+            return;
+        this.#orphanTimer = setTimeout(() => this.#options.onExpire(this), timeout);
+        this.#orphanTimer.unref();
+    }
+    #clearOrphanTimer() {
+        if (this.#orphanTimer)
+            clearTimeout(this.#orphanTimer);
+        this.#orphanTimer = null;
+    }
+    /** Attach a client, replacing any existing one. Returns buffered output to replay. */
+    attach(client) {
+        const previous = this.#client;
+        this.#client = client;
+        this.#clientGeneration += 1;
+        this.#pendingBytes = 0;
+        if (this.#paused)
+            this.#setPaused(false);
+        this.#clearOrphanTimer();
+        previous?.replaced();
+        return this.#buffer.snapshot();
+    }
+    detach(client) {
+        if (this.#client !== client)
+            return;
+        this.#client = null;
+        this.#clientGeneration += 1;
+        this.#pendingBytes = 0;
+        // While detached, keep draining the PTY into the bounded buffer so the
+        // remote program never blocks on a full output pipe.
+        if (this.#paused)
+            this.#setPaused(false);
+        this.#startOrphanTimer();
+    }
+    write(data) {
+        if (!this.#exit)
+            this.#pty.write(data);
+    }
+    resize(size) {
+        if (!this.#exit)
+            this.#pty.resize(size);
+    }
+    terminate() {
+        this.#clearOrphanTimer();
+        this.#pty.kill();
+    }
+}

package/runtime/server/src/modules/terminal/terminal-socket.js

@@ -0,0 +1,170 @@
+import { terminalClientMessageSchema } from "../../../../src/schema/terminal.js";
+import { isAppError } from "../../lib/errors.js";
+const HANDSHAKE_TIMEOUT_MS = 10_000;
+const HEARTBEAT_INTERVAL_MS = 30_000;
+// Application close codes (4000-4999 are reserved for applications).
+export const CLOSE_PROTOCOL_ERROR = 4000;
+export const CLOSE_SESSION_NOT_FOUND = 4004;
+export const CLOSE_REPLACED = 4009;
+export const CLOSE_TERMINATED = 4010;
+export const CLOSE_UNAUTHORIZED = 4401;
+/**
+ * Bridges one WebSocket to one terminal session. The first message must be
+ * `create` or `attach`; afterwards the socket carries input/resize/terminate
+ * messages in and raw output bytes out. Closing the socket only detaches —
+ * the session survives until it is terminated or reaped as an orphan.
+ *
+ * Authorization is checked before every action, with push revocation and an
+ * expiry timer. Heartbeats provide a fallback and detect half-open sockets.
+ */
+export function handleTerminalSocket(socket, manager, logger, isAuthorized, heartbeatIntervalMs = HEARTBEAT_INTERVAL_MS, onActivity = () => undefined, subscribeRevocation, expiresIn) {
+    let session = null;
+    let client = null;
+    let establishing = false;
+    let alive = true;
+    const send = (message) => {
+        if (socket.readyState === socket.OPEN)
+            socket.send(JSON.stringify(message));
+    };
+    const fail = (code, message, closeCode) => {
+        send({ type: 'error', code, message });
+        socket.close(closeCode, code);
+    };
+    const unauthorized = () => fail('UNAUTHORIZED', 'Your session expired—sign in to reconnect.', CLOSE_UNAUTHORIZED);
+    const unsubscribe = subscribeRevocation?.(unauthorized);
+    let expiryTimer;
+    const scheduleExpiry = () => {
+        if (!expiresIn)
+            return;
+        const remaining = expiresIn();
+        if (remaining <= 0) {
+            unauthorized();
+            return;
+        }
+        expiryTimer = setTimeout(scheduleExpiry, Math.min(remaining, 2_147_483_647));
+    };
+    const handshakeTimer = setTimeout(() => {
+        if (!session)
+            fail('BAD_REQUEST', 'No session was requested.', CLOSE_PROTOCOL_ERROR);
+    }, HANDSHAKE_TIMEOUT_MS);
+    // Detect half-open connections (common on mobile) so orphaned sessions are
+    // detached promptly and start their expiry timer.
+    const heartbeat = setInterval(() => {
+        if (!isAuthorized()) {
+            unauthorized();
+            return;
+        }
+        if (!alive) {
+            socket.terminate();
+            return;
+        }
+        alive = false;
+        socket.ping();
+    }, heartbeatIntervalMs);
+    socket.on('pong', () => {
+        alive = true;
+    });
+    const bind = (target) => {
+        session = target;
+        clearTimeout(handshakeTimer);
+        client = {
+            sendOutput(chunk, flushed) {
+                if (socket.readyState !== socket.OPEN)
+                    return flushed();
+                socket.send(chunk, { binary: true }, () => flushed());
+            },
+            sendExit(exit) {
+                send({ type: 'exit', exitCode: exit.exitCode, signal: exit.signal });
+            },
+            replaced() {
+                send({ type: 'detached' });
+                socket.close(CLOSE_REPLACED, 'replaced');
+            },
+        };
+        const replay = target.attach(client);
+        send({ type: 'ready', sessionId: target.id, replay: replay.length > 0 });
+        if (replay.length > 0)
+            socket.send(replay, { binary: true });
+        if (target.exit)
+            client.sendExit(target.exit);
+    };
+    socket.on('message', (raw, isBinary) => {
+        if (socket.readyState !== socket.OPEN)
+            return;
+        if (!isAuthorized())
+            return unauthorized();
+        if (isBinary)
+            return fail('BAD_REQUEST', 'Binary client frames are not supported.', CLOSE_PROTOCOL_ERROR);
+        let parsed;
+        try {
+            parsed = terminalClientMessageSchema.safeParse(JSON.parse(raw.toString()));
+        }
+        catch {
+            return fail('BAD_REQUEST', 'Malformed message.', CLOSE_PROTOCOL_ERROR);
+        }
+        if (!parsed.success)
+            return fail('BAD_REQUEST', 'Invalid message.', CLOSE_PROTOCOL_ERROR);
+        const message = parsed.data;
+        if (!session) {
+            if (establishing)
+                return;
+            if (message.type === 'create') {
+                establishing = true;
+                manager.create(message.workspaceId, { cols: message.cols, rows: message.rows }).then((created) => {
+                    // The browser went away before learning the id: nobody can ever attach.
+                    if (socket.readyState !== socket.OPEN) {
+                        manager.terminate(created.id);
+                        return;
+                    }
+                    if (!isAuthorized()) {
+                        manager.terminate(created.id);
+                        unauthorized();
+                        return;
+                    }
+                    onActivity();
+                    bind(created);
+                }, (error) => {
+                    if (!isAppError(error))
+                        logger.error({ err: error }, 'failed to create terminal session');
+                    fail(isAppError(error) ? error.code : 'INTERNAL', isAppError(error) ? error.message : 'Failed to start terminal.', CLOSE_PROTOCOL_ERROR);
+                });
+                return;
+            }
+            if (message.type === 'attach') {
+                const existing = manager.get(message.sessionId);
+                if (!existing)
+                    return fail('SESSION_NOT_FOUND', 'This terminal session no longer exists.', CLOSE_SESSION_NOT_FOUND);
+                existing.resize({ cols: message.cols, rows: message.rows });
+                bind(existing);
+                return;
+            }
+            return fail('BAD_REQUEST', 'Create or attach to a session first.', CLOSE_PROTOCOL_ERROR);
+        }
+        const current = session;
+        switch (message.type) {
+            case 'input':
+                onActivity();
+                current.write(message.data);
+                break;
+            case 'resize':
+                current.resize({ cols: message.cols, rows: message.rows });
+                break;
+            case 'terminate':
+                manager.terminate(current.id);
+                socket.close(CLOSE_TERMINATED, 'terminated');
+                break;
+            default:
+                fail('BAD_REQUEST', 'Session already established.', CLOSE_PROTOCOL_ERROR);
+        }
+    });
+    socket.on('close', () => {
+        clearTimeout(handshakeTimer);
+        clearTimeout(expiryTimer);
+        unsubscribe?.();
+        clearInterval(heartbeat);
+        if (session && client)
+            session.detach(client);
+    });
+    socket.on('error', (error) => logger.debug({ err: error }, 'terminal socket error'));
+    scheduleExpiry();
+}

package/runtime/server/src/modules/terminal/terminal.routes.js

@@ -0,0 +1,19 @@
+import { terminalSessionParamsSchema } from "../../../../src/schema/terminal.js";
+import { AppError } from "../../lib/errors.js";
+import { parseInput } from "../../lib/validation.js";
+import { SESSION_COOKIE } from "../auth/auth-security.js";
+import { handleTerminalSocket } from "./terminal-socket.js";
+export function registerTerminalRoutes(app, terminals, tokens) {
+    app.get('/api/terminals', async () => ({ sessions: terminals.list() }));
+    // Lets the UI terminate a session whose WebSocket is not currently connected.
+    app.delete('/api/terminals/:id', async (request, reply) => {
+        const { id } = parseInput(terminalSessionParamsSchema, request.params);
+        if (!terminals.terminate(id))
+            throw new AppError('SESSION_NOT_FOUND', 'Terminal session not found.');
+        return reply.status(204).send();
+    });
+    app.get('/ws/terminal', { websocket: true }, (socket, request) => {
+        const token = request.cookies[SESSION_COOKIE];
+        handleTerminalSocket(socket, terminals, request.log, () => tokens.verify(token), undefined, () => { tokens.touch(token); }, (listener) => tokens.onRevoked(token, listener), () => tokens.remainingMs(token));
+    });
+}

package/runtime/server/src/modules/workspace/workspace-registry.js

@@ -0,0 +1,231 @@
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { AppError } from "../../lib/errors.js";
+import { SshCommandRunner } from "../exec/command-runner.js";
+import { LocalFileSystemDriver } from "../filesystem/local-driver.js";
+import { SftpFileSystemDriver } from "../filesystem/sftp-driver.js";
+import { RestrictedFileSystemDriver } from "../filesystem/restricted-driver.js";
+import { WorkspaceFileService } from "../filesystem/workspace-file-service.js";
+import { GitService } from "../git/git-service.js";
+import { browseDirectories } from "../hosts/directory-browser.js";
+import { hostLabel } from "../hosts/host-service.js";
+import { SshPtyProvider } from "../terminal/ssh-pty-provider.js";
+/**
+ * The projects configured in the UI. Each project is a folder on a host (or
+ * on the machine running the server) and gets its own lazily created file and
+ * Git services. Runtimes are dropped whenever the project or its host changes.
+ */
+export class WorkspaceRegistry {
+    #store;
+    #hosts;
+    #terminals;
+    #options;
+    #logger;
+    #runtimes = new Map();
+    #localDriver = new LocalFileSystemDriver();
+    constructor(store, hosts, terminals, options, logger) {
+        this.#store = store;
+        this.#hosts = hosts;
+        this.#terminals = terminals;
+        this.#options = options;
+        this.#logger = logger;
+        hosts.onChange((hostId) => {
+            for (const [id, runtime] of this.#runtimes)
+                if (runtime.hostId === hostId)
+                    this.#runtimes.delete(id);
+            for (const workspace of this.#store.state.workspaces)
+                if (workspace.hostId === hostId)
+                    this.#terminals.terminateWorkspace(workspace.id);
+        });
+    }
+    list() {
+        return this.#store.state.workspaces.map(({ id, name, hostId, root, ports, createdAt }) => ({ id, name, hostId, root, ports, createdAt }));
+    }
+    get(id) {
+        const workspace = this.#store.state.workspaces.find((candidate) => candidate.id === id);
+        if (!workspace)
+            throw new AppError('NOT_FOUND', 'Project not found.');
+        return workspace;
+    }
+    #driver(hostId) {
+        const raw = hostId ? new SftpFileSystemDriver(this.#hosts.connection(hostId)) : this.#localDriver;
+        return new RestrictedFileSystemDriver(raw, hostId ? this.#options.workspace.sshRoots : this.#options.workspace.localRoots, () => hostId ? [] : [
+            ...this.#options.workspace.protectedPaths,
+            ...this.#store.state.hosts.flatMap((host) => host.auth.type === 'key-file' ? [host.auth.path] : []),
+        ]);
+    }
+    #runner(hostId) {
+        if (!hostId)
+            throw new AppError('FORBIDDEN', 'Use an SSH host for Git so repository programs cannot access backend credentials.');
+        return new SshCommandRunner(this.#hosts.connection(hostId));
+    }
+    /** Directory picker for choosing a project folder ("local" = the server's machine). */
+    async browse(host, requestPath) {
+        const hostId = host === 'local' ? null : this.#hosts.get(host).id;
+        const driver = this.#driver(hostId);
+        if (!requestPath) {
+            const roots = await driver.roots();
+            if (roots.length === 0)
+                throw new AppError('FORBIDDEN', 'No permitted folders are configured for this host. Ask the administrator to configure workspace roots.');
+            return { path: '', roots: roots.map((entry) => entry.name), parent: null, entries: roots.map((entry) => ({ name: entry.name, path: entry.name })), truncated: false };
+        }
+        const result = await browseDirectories(driver, requestPath, hostId === null);
+        if (result.parent) {
+            try {
+                await driver.check(result.parent);
+            }
+            catch {
+                result.parent = null;
+            }
+        }
+        result.roots = (await driver.roots()).map((entry) => entry.name);
+        return result;
+    }
+    async #canonicalDirectory(hostId, root) {
+        const driver = this.#driver(hostId);
+        const canonical = await driver.checkWorkspace(path.posix.normalize(root)).catch((error) => {
+            if (error instanceof AppError && error.code === 'NOT_FOUND')
+                throw new AppError('NOT_FOUND', `Folder ${root} does not exist.`);
+            throw error;
+        });
+        if ((await driver.stat(canonical)).type !== 'directory')
+            throw new AppError('NOT_A_DIRECTORY', `${root} is not a folder.`);
+        return canonical;
+    }
+    async create(input) {
+        if (input.hostId)
+            this.#hosts.get(input.hostId);
+        const root = await this.#canonicalDirectory(input.hostId, input.root);
+        if (this.#store.state.workspaces.some((workspace) => workspace.hostId === input.hostId && workspace.root === root)) {
+            throw new AppError('CONFLICT', 'This folder is already a project.');
+        }
+        const workspace = {
+            id: randomUUID(),
+            name: input.name || path.posix.basename(root) || root,
+            hostId: input.hostId,
+            root,
+            ports: [],
+            createdAt: new Date().toISOString(),
+        };
+        this.#store.update((draft) => {
+            draft.workspaces.push(workspace);
+        });
+        this.#logger.info({ workspaceId: workspace.id, hostId: workspace.hostId }, 'project added');
+        return workspace;
+    }
+    async update(id, input) {
+        const current = this.get(id);
+        const root = input.root ? await this.#canonicalDirectory(current.hostId, input.root) : current.root;
+        const next = { ...current, name: input.name ?? current.name, root, ports: input.ports ?? current.ports };
+        this.#store.update((draft) => {
+            draft.workspaces = draft.workspaces.map((workspace) => (workspace.id === id ? next : workspace));
+        });
+        this.#runtimes.delete(id);
+        if (root !== current.root)
+            this.#terminals.terminateWorkspace(id);
+        return next;
+    }
+    /** Remove a project and terminate its terminals. Files on the host are never touched. */
+    remove(id) {
+        this.get(id);
+        this.#terminals.terminateWorkspace(id);
+        this.#runtimes.delete(id);
+        this.#store.update((draft) => {
+            draft.workspaces = draft.workspaces.filter((workspace) => workspace.id !== id);
+        });
+        this.#logger.info({ workspaceId: id }, 'project removed');
+    }
+    /** Remove a host together with its projects and their terminals. */
+    removeHost(hostId) {
+        this.#hosts.get(hostId);
+        for (const workspace of this.#store.state.workspaces) {
+            if (workspace.hostId !== hostId)
+                continue;
+            this.#terminals.terminateWorkspace(workspace.id);
+            this.#runtimes.delete(workspace.id);
+        }
+        this.#hosts.remove(hostId);
+    }
+    #terminalsAvailable(workspace) {
+        return this.#options.ptyOverride !== undefined ? this.#options.ptyOverride !== null : workspace.hostId !== null;
+    }
+    info(id) {
+        const workspace = this.get(id);
+        const host = workspace.hostId ? this.#hosts.find(workspace.hostId) : undefined;
+        const connection = host ? this.#hosts.summary(host).connection : { status: 'connected', error: null };
+        return {
+            id: workspace.id,
+            name: workspace.name,
+            root: workspace.root,
+            backend: workspace.hostId ? 'ssh' : 'local',
+            hostId: workspace.hostId,
+            hostName: host?.name ?? null,
+            host: host ? hostLabel(host) : null,
+            address: host?.host ?? null,
+            ports: workspace.ports,
+            connection,
+            terminalsAvailable: this.#terminalsAvailable(workspace),
+            limits: { maxFileBytes: this.#options.limits.maxFileBytes },
+        };
+    }
+    /** Force a fresh control connection for the project's host (no-op for local projects). */
+    async reconnect(id) {
+        const { hostId } = this.get(id);
+        if (hostId)
+            await this.#hosts.connection(hostId).reconnect();
+    }
+    #runtime(id) {
+        let runtime = this.#runtimes.get(id);
+        if (!runtime) {
+            const workspace = this.get(id);
+            const { limits } = this.#options;
+            runtime = {
+                hostId: workspace.hostId,
+                files: new WorkspaceFileService(this.#driver(workspace.hostId), {
+                    root: workspace.root,
+                    validateRoot: () => this.#canonicalDirectory(workspace.hostId, workspace.root).then(() => undefined),
+                    maxFileBytes: limits.maxFileBytes,
+                    maxImageBytes: limits.maxImageBytes,
+                    maxDirEntries: limits.maxDirEntries,
+                }),
+                git: workspace.hostId ? new GitService(this.#runner(workspace.hostId), {
+                    workspaceRoot: workspace.root,
+                    maxDiffBytes: limits.maxDiffBytes,
+                    maxChanges: limits.maxGitChanges,
+                }) : null,
+            };
+            this.#runtimes.set(id, runtime);
+        }
+        return runtime;
+    }
+    files(id) {
+        return this.#runtime(id).files;
+    }
+    async git(id) {
+        const workspace = this.get(id);
+        await this.#canonicalDirectory(workspace.hostId, workspace.root);
+        const git = this.#runtime(id).git;
+        if (!git)
+            throw new AppError('FORBIDDEN', 'Use an SSH host for Git so repository programs cannot access backend credentials.');
+        return git;
+    }
+    /** PTY provider for a project's terminals: a login shell on its host, started in the project folder. */
+    ptyProvider(id) {
+        const workspace = this.get(id);
+        if (this.#options.ptyOverride !== undefined) {
+            if (!this.#options.ptyOverride)
+                throw new AppError('TERMINAL_UNAVAILABLE', 'Terminals are disabled.');
+            return this.#options.ptyOverride;
+        }
+        const hostId = workspace.hostId;
+        if (!hostId)
+            throw new AppError('TERMINAL_UNAVAILABLE', 'Terminals are only available for projects on SSH hosts.');
+        return {
+            // Config is resolved per spawn so credential changes apply to new terminals.
+            spawn: async (size) => {
+                await this.#canonicalDirectory(hostId, workspace.root);
+                return new SshPtyProvider(this.#hosts.sshConfig(hostId), { term: this.#options.term, startDirectory: workspace.root }, this.#logger).spawn(size);
+            },
+        };
+    }
+}

package/runtime/server/src/modules/workspace/workspace.routes.js

@@ -0,0 +1,97 @@
+import { createEntryRequestSchema, createWorkspaceRequestSchema, deleteEntryRequestSchema, pathQuerySchema, rawFileQuerySchema, renameEntryRequestSchema, transferEntryRequestSchema, updateWorkspaceRequestSchema, workspaceIdParamsSchema, writeFileRequestSchema, } from "../../../../src/schema/workspace.js";
+import { parseInput } from "../../lib/validation.js";
+/** Content-Disposition with an ASCII fallback name and the exact UTF-8 one (RFC 6266). */
+function contentDisposition(type, name) {
+    const fallback = name.replace(/[^\x20-\x7e]|["\\%]/g, '_');
+    const encoded = encodeURIComponent(name).replace(/['()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+    return `${type}; filename="${fallback}"; filename*=UTF-8''${encoded}`;
+}
+export function registerWorkspaceRoutes(app, workspaces, maxFileBytes) {
+    app.get('/api/workspaces', async () => ({ workspaces: workspaces.list() }));
+    app.post('/api/workspaces', async (request, reply) => {
+        const created = await workspaces.create(parseInput(createWorkspaceRequestSchema, request.body));
+        return reply.status(201).send(created);
+    });
+    app.get('/api/workspaces/:workspaceId', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        return workspaces.info(workspaceId);
+    });
+    app.patch('/api/workspaces/:workspaceId', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        return workspaces.update(workspaceId, parseInput(updateWorkspaceRequestSchema, request.body));
+    });
+    app.delete('/api/workspaces/:workspaceId', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        workspaces.remove(workspaceId);
+        return reply.status(204).send();
+    });
+    app.post('/api/workspaces/:workspaceId/reconnect', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        await workspaces.reconnect(workspaceId);
+        return workspaces.info(workspaceId);
+    });
+    app.get('/api/workspaces/:workspaceId/tree', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path } = parseInput(pathQuerySchema, request.query);
+        return workspaces.files(workspaceId).listDirectory(path);
+    });
+    app.get('/api/workspaces/:workspaceId/file', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path } = parseInput(pathQuerySchema, request.query);
+        return workspaces.files(workspaceId).readFile(path);
+    });
+    app.get('/api/workspaces/:workspaceId/file/raw', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path, download } = parseInput(rawFileQuerySchema, request.query);
+        const file = await workspaces.files(workspaceId).openRaw(path, { download: download === '1', range: request.headers.range });
+        reply
+            .type(file.contentType)
+            .header('Cache-Control', 'no-store')
+            .header('Accept-Ranges', 'bytes')
+            .header('Content-Disposition', contentDisposition(download === '1' ? 'attachment' : 'inline', file.name))
+            // Sandboxed and script-free even if an SVG is opened directly in a tab.
+            .header('Content-Security-Policy', "default-src 'none'; img-src data:; media-src 'self'; style-src 'unsafe-inline'; sandbox");
+        if (file.range) {
+            reply
+                .status(206)
+                .header('Content-Range', `bytes ${file.range.start}-${file.range.end}/${file.size}`)
+                .header('Content-Length', file.range.end - file.range.start + 1);
+        }
+        else {
+            reply.header('Content-Length', file.size);
+        }
+        return reply.send(file.stream);
+    });
+    // JSON escaping can double the size of a file's text, so allow headroom over MAX_FILE_BYTES.
+    app.put('/api/workspaces/:workspaceId/file', { bodyLimit: maxFileBytes * 2 + 64 * 1024 }, async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path, content, expectedMtimeMs } = parseInput(writeFileRequestSchema, request.body);
+        return workspaces.files(workspaceId).writeFile(path, content, expectedMtimeMs);
+    });
+    app.post('/api/workspaces/:workspaceId/entries', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path, type } = parseInput(createEntryRequestSchema, request.body);
+        return reply.status(201).send(await workspaces.files(workspaceId).createEntry(path, type));
+    });
+    app.post('/api/workspaces/:workspaceId/entries/copy', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path, destination } = parseInput(transferEntryRequestSchema, request.body);
+        return reply.status(201).send(await workspaces.files(workspaceId).copyEntry(path, destination));
+    });
+    app.post('/api/workspaces/:workspaceId/entries/move', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path, destination } = parseInput(transferEntryRequestSchema, request.body);
+        return workspaces.files(workspaceId).moveEntry(path, destination);
+    });
+    app.post('/api/workspaces/:workspaceId/entries/rename', async (request) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path, name } = parseInput(renameEntryRequestSchema, request.body);
+        return workspaces.files(workspaceId).renameEntry(path, name);
+    });
+    app.post('/api/workspaces/:workspaceId/entries/delete', async (request, reply) => {
+        const { workspaceId } = parseInput(workspaceIdParamsSchema, request.params);
+        const { path } = parseInput(deleteEntryRequestSchema, request.body);
+        await workspaces.files(workspaceId).deleteEntry(path);
+        return reply.status(204).send();
+    });
+}

package/runtime/server/src/scripts/reset-password.js

@@ -0,0 +1,21 @@
+import { loadConfig } from "../config/config.js";
+import { AppStore } from "../modules/store/app-store.js";
+/**
+ * Forgot the password? Stop the server, run this, and start it again: the
+ * password is cleared, everyone is signed out, and the server prints a new
+ * setup link. Hosts, keys, and projects are kept.
+ */
+try {
+    const config = loadConfig();
+    const store = AppStore.open(config.dataDir);
+    store.update((draft) => {
+        draft.auth = null;
+        draft.sessions = [];
+    });
+    console.log('Password cleared and all sessions signed out.');
+    console.log('Start the server again and open the setup link it prints to choose a new password.');
+}
+catch (error) {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+}