@dotobokuri/fleet-console 1.40.0 → 1.41.0

package/dist/fleet-plugins/file-explorer/routes.mjs

@@ -1,18 +1,135 @@
 #!/usr/bin/env node
-import fs from 'fs';
-import path2 from 'path';
-import fs5 from 'fs/promises';
+import { execFile, spawn } from 'child_process';
+import fs3, { constants } from 'fs';
+import fs8 from 'fs/promises';
+import path4 from 'path';
 
 // sdk/plugin/node.ts
 function definePlugin(definition) {
   return definition;
 }
-function registerRouter(ctx, path6, handler) {
-  ctx.registerRouter(normalizePath(path6), handler);
+function registerRouter(ctx, path10, handler) {
+  ctx.registerRouter(normalizePath(path10), handler);
 }
-function normalizePath(path6) {
-  if (path6.length === 0 || path6 === "/") return "/";
-  return path6;
+function normalizePath(path10) {
+  if (path10.length === 0 || path10 === "/") return "/";
+  return path10;
+}
+var PathActionError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.name = "PathActionError";
+    this.code = code;
+  }
+};
+async function resolveContainedActionPath(theaterPath, relativePath) {
+  if (path4.isAbsolute(relativePath)) throw new PathActionError("path_outside_theater");
+  const rootPath = path4.resolve(theaterPath);
+  const candidatePath = path4.resolve(rootPath, relativePath);
+  if (!isPathContained(rootPath, candidatePath)) throw new PathActionError("path_outside_theater");
+  let realRootPath;
+  let realCandidatePath;
+  try {
+    [realRootPath, realCandidatePath] = await Promise.all([
+      fs8.realpath(rootPath),
+      fs8.realpath(candidatePath)
+    ]);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EACCES" || code === "EPERM") throw new PathActionError("forbidden");
+    throw new PathActionError("not_found");
+  }
+  if (!isPathContained(realRootPath, realCandidatePath)) {
+    throw new PathActionError("path_outside_theater");
+  }
+  return {
+    // Preserve the row the user acted on for display-only actions such as copying path text.
+    logicalPath: candidatePath,
+    // Process-launch actions must use the same resolved path that passed containment.
+    realPath: realCandidatePath
+  };
+}
+function isPathContained(rootPath, candidatePath) {
+  const relative = path4.relative(rootPath, candidatePath);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative);
+}
+
+// ../fleet-plugins/file-explorer/server/clipboard.ts
+var ClipboardUnavailableError = class extends Error {
+  constructor() {
+    super("clipboard_unavailable");
+    this.name = "ClipboardUnavailableError";
+  }
+};
+var LINUX_CLIPBOARD_TOOLS = [
+  { name: "wl-copy", args: [] },
+  { name: "xclip", args: ["-selection", "clipboard"] },
+  { name: "xsel", args: ["--clipboard", "--input"] }
+];
+var DEFAULT_DEPENDENCIES = {
+  platform: process.platform,
+  findExecutable: findExecutableOnPath,
+  runWithInput: execFileWithInput
+};
+async function copyPathToClipboard(theaterPath, relativePath, dependencies = {}) {
+  const deps = { ...DEFAULT_DEPENDENCIES, ...dependencies };
+  const { logicalPath } = await resolveContainedActionPath(theaterPath, relativePath);
+  const command = await resolveClipboardCommand(deps.platform, deps.findExecutable);
+  if (!command) throw new ClipboardUnavailableError();
+  try {
+    await deps.runWithInput(command.file, command.args, logicalPath);
+  } catch (error) {
+    if (error.code === "ENOENT") throw new ClipboardUnavailableError();
+    throw error;
+  }
+}
+async function resolveClipboardCommand(platform, findExecutable = findExecutableOnPath) {
+  if (platform === "darwin") return { file: "pbcopy", args: [] };
+  if (platform === "win32") return { file: "clip.exe", args: [] };
+  if (platform !== "linux") return null;
+  for (const candidate of LINUX_CLIPBOARD_TOOLS) {
+    const executable = await findExecutable(candidate.name);
+    if (executable) return { file: executable, args: candidate.args };
+  }
+  return null;
+}
+async function findExecutableOnPath(name) {
+  const rawPath = process.env.PATH ?? "";
+  for (const directory of rawPath.split(path4.delimiter)) {
+    if (!directory) continue;
+    const candidate = path4.join(directory, name);
+    try {
+      await fs8.access(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function execFileWithInput(file, args, input) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      if (error) reject(error);
+      else resolve();
+    };
+    const child = execFile(
+      file,
+      [...args],
+      { shell: false, timeout: 5e3, windowsHide: true },
+      (error) => finish(error)
+    );
+    child.once("error", finish);
+    if (!child.stdin) {
+      finish(new Error("clipboard stdin unavailable"));
+      return;
+    }
+    child.stdin.once("error", finish);
+    child.stdin.end(input);
+  });
 }
 var FileReadError = class extends Error {
   code;
@@ -69,14 +186,14 @@ var EXT_LANG_MAP = {
   ".txt": "plaintext"
 };
 async function readFileForTheater(theaterPath, relativePath) {
-  const resolved = path2.resolve(theaterPath, relativePath);
+  const resolved = path4.resolve(theaterPath, relativePath);
   if (!isWithinRoot(resolved, theaterPath)) throw new FileReadError("path_outside_theater");
   let realResolved;
   let realRoot;
   try {
     [realResolved, realRoot] = await Promise.all([
-      fs.promises.realpath(resolved),
-      fs.promises.realpath(theaterPath)
+      fs3.promises.realpath(resolved),
+      fs3.promises.realpath(theaterPath)
     ]);
   } catch (error) {
     const code = error.code;
@@ -86,7 +203,7 @@ async function readFileForTheater(theaterPath, relativePath) {
   if (!isWithinRoot(realResolved, realRoot)) throw new FileReadError("path_outside_theater");
   let stat;
   try {
-    stat = await fs.promises.stat(realResolved);
+    stat = await fs3.promises.stat(realResolved);
   } catch (error) {
     const code = error.code;
     if (code === "EACCES" || code === "EPERM") throw new FileReadError("forbidden");
@@ -94,29 +211,29 @@ async function readFileForTheater(theaterPath, relativePath) {
   }
   if (!stat.isFile()) throw new FileReadError("not_a_file");
   if (stat.size > FILE_SIZE_CAP) {
-    const fd = await fs.promises.open(realResolved, "r");
+    const fd = await fs3.promises.open(realResolved, "r");
     const buffer2 = Buffer.alloc(FILE_SIZE_CAP);
     const { bytesRead } = await fd.read(buffer2, 0, FILE_SIZE_CAP, 0);
     await fd.close();
     const chunk = buffer2.subarray(0, bytesRead);
     if (isBinaryBuffer(chunk)) throw new FileReadError("binary_file");
     return {
-      relativePath: path2.relative(realRoot, realResolved),
+      relativePath: path4.relative(realRoot, realResolved),
       content: chunk.toString("utf8"),
       lang: detectLang(realResolved),
       truncated: true
     };
   }
-  const buffer = await fs.promises.readFile(realResolved);
+  const buffer = await fs3.promises.readFile(realResolved);
   if (isBinaryBuffer(buffer)) throw new FileReadError("binary_file");
   return {
-    relativePath: path2.relative(realRoot, realResolved),
+    relativePath: path4.relative(realRoot, realResolved),
     content: buffer.toString("utf8"),
     lang: detectLang(realResolved)
   };
 }
 function isWithinRoot(resolved, root) {
-  const normalizedRoot = root.endsWith(path2.sep) ? root : root + path2.sep;
+  const normalizedRoot = root.endsWith(path4.sep) ? root : root + path4.sep;
   return resolved === root || resolved.startsWith(normalizedRoot);
 }
 function isBinaryBuffer(buffer) {
@@ -129,7 +246,7 @@ function isBinaryBuffer(buffer) {
   return nulCount / checkLen > BINARY_NUL_THRESHOLD;
 }
 function detectLang(filePath) {
-  const ext = path2.extname(filePath).toLowerCase();
+  const ext = path4.extname(filePath).toLowerCase();
   return EXT_LANG_MAP[ext] ?? "plaintext";
 }
 var FolderBrowserError = class extends Error {
@@ -142,10 +259,10 @@ var FolderBrowserError = class extends Error {
 };
 var DIRECTORY_ENTRY_CAP = 500;
 async function listTheaterContents(theaterPath, relativePath, deps = {}) {
-  const opendir = deps.opendir ?? fs.promises.opendir;
-  const stat = deps.stat ?? fs.promises.stat;
-  const targetAbs = path2.resolve(theaterPath, relativePath);
-  const normalizedRoot = theaterPath.endsWith(path2.sep) ? theaterPath : theaterPath + path2.sep;
+  const opendir = deps.opendir ?? fs3.promises.opendir;
+  const stat = deps.stat ?? fs3.promises.stat;
+  const targetAbs = path4.resolve(theaterPath, relativePath);
+  const normalizedRoot = theaterPath.endsWith(path4.sep) ? theaterPath : theaterPath + path4.sep;
   if (targetAbs !== theaterPath && !targetAbs.startsWith(normalizedRoot)) {
     throw new FolderBrowserError("forbidden");
   }
@@ -153,13 +270,13 @@ async function listTheaterContents(theaterPath, relativePath, deps = {}) {
   let realTargetAbs;
   try {
     [realRoot, realTargetAbs] = await Promise.all([
-      fs.promises.realpath(theaterPath),
-      fs.promises.realpath(targetAbs)
+      fs3.promises.realpath(theaterPath),
+      fs3.promises.realpath(targetAbs)
     ]);
   } catch (error) {
     throw mapFsError(error);
   }
-  const realNormalizedRoot = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
+  const realNormalizedRoot = realRoot.endsWith(path4.sep) ? realRoot : realRoot + path4.sep;
   if (realTargetAbs !== realRoot && !realTargetAbs.startsWith(realNormalizedRoot)) {
     throw new FolderBrowserError("forbidden");
   }
@@ -171,8 +288,8 @@ async function listTheaterContents(theaterPath, relativePath, deps = {}) {
     if (a.kind !== b.kind) return a.kind === "dir" ? -1 : 1;
     return a.name.localeCompare(b.name);
   });
-  const rel = path2.relative(realRoot, realTargetAbs);
-  const parentRel = rel === "" ? null : path2.relative(realRoot, path2.dirname(realTargetAbs));
+  const rel = path4.relative(realRoot, realTargetAbs);
+  const parentRel = rel === "" ? null : path4.relative(realRoot, path4.dirname(realTargetAbs));
   return {
     relativePath: rel,
     parentRelativePath: parentRel === "" ? null : parentRel ?? null,
@@ -212,14 +329,14 @@ async function openDirectory(targetPath, opendir) {
   }
 }
 async function toContentsEntry(targetPath, theaterPath, dirent, stat) {
-  const entryPath = path2.join(targetPath, dirent.name);
-  const rel = path2.relative(theaterPath, entryPath);
+  const entryPath = path4.join(targetPath, dirent.name);
+  const rel = path4.relative(theaterPath, entryPath);
   if (dirent.isDirectory()) return { name: dirent.name, relativePath: rel, kind: "dir" };
   if (dirent.isFile()) return { name: dirent.name, relativePath: rel, kind: "file" };
   if (dirent.isSymbolicLink()) {
     try {
-      const realEntryPath = await fs.promises.realpath(entryPath);
-      const realNormalizedRoot = theaterPath.endsWith(path2.sep) ? theaterPath : theaterPath + path2.sep;
+      const realEntryPath = await fs3.promises.realpath(entryPath);
+      const realNormalizedRoot = theaterPath.endsWith(path4.sep) ? theaterPath : theaterPath + path4.sep;
       if (realEntryPath !== theaterPath && !realEntryPath.startsWith(realNormalizedRoot)) return null;
       const s = await stat(realEntryPath);
       if (s.isDirectory()) return { name: dirent.name, relativePath: rel, kind: "dir" };
@@ -236,6 +353,142 @@ function mapFsError(error) {
   if (code === "ENOENT" || code === "ENOTDIR") return new FolderBrowserError("not_found");
   return new FolderBrowserError("invalid_path");
 }
+var GitStatusPathError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.name = "GitStatusPathError";
+    this.code = code;
+  }
+};
+var GIT_TIMEOUT_MS = 5e3;
+var GIT_MAX_BUFFER = 8 * 1024 * 1024;
+var GIT_STATUS_CAP = 1e4;
+var UNMERGED_STATUS_PAIRS = /* @__PURE__ */ new Set(["UU", "UD", "DU", "AA", "AU", "UA", "DD"]);
+async function readTheaterGitStatus(theaterPath, deps = {}) {
+  const realpath = deps.realpath ?? ((target) => fs8.realpath(target));
+  const execGit = deps.execGit ?? executeGit;
+  let theaterRootAbs;
+  try {
+    theaterRootAbs = await realpath(path4.resolve(theaterPath));
+  } catch (error) {
+    throw mapFsError2(error);
+  }
+  try {
+    const options = {
+      env: sanitizeGitEnvironment(deps.environment ?? process.env),
+      killSignal: "SIGKILL",
+      maxBuffer: GIT_MAX_BUFFER,
+      timeout: GIT_TIMEOUT_MS
+    };
+    const gitArgs = (args) => [
+      "-c",
+      "core.fsmonitor=false",
+      "--no-optional-locks",
+      "-C",
+      theaterRootAbs,
+      ...args
+    ];
+    const [prefixOutput, statusOutput] = await Promise.all([
+      execGit(gitArgs(["rev-parse", "--show-prefix"]), options),
+      execGit(gitArgs(["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "."]), options)
+    ]);
+    const prefix = stripTrailingLineBreak(prefixOutput);
+    const statuses = scopeGitStatusesToTheater(parseGitStatusPorcelainV1Z(statusOutput), prefix);
+    const truncated = statuses.length > GIT_STATUS_CAP;
+    return {
+      ok: true,
+      gitAvailable: true,
+      statuses: statuses.slice(0, GIT_STATUS_CAP),
+      ...truncated ? { truncated: true } : {}
+    };
+  } catch {
+    return { ok: true, gitAvailable: false, statuses: [] };
+  }
+}
+function parseGitStatusPorcelainV1Z(output) {
+  const records = output.split("\0");
+  const statuses = [];
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index];
+    if (!record || record.length < 4 || record[2] !== " ") continue;
+    const indexStatus = record[0] ?? " ";
+    const worktreeStatus = record[1] ?? " ";
+    const statusPair = `${indexStatus}${worktreeStatus}`;
+    const gitPath = record.slice(3);
+    const isRenameOrCopy = statusPair.includes("R") || statusPair.includes("C");
+    const status = classifyGitStatus(statusPair);
+    if (status && gitPath) statuses.push({ gitPath, status });
+    if (isRenameOrCopy && index + 1 < records.length) index += 1;
+  }
+  return statuses;
+}
+function scopeGitStatusesToTheater(entries, prefix, separator = path4.sep) {
+  const statuses = [];
+  for (const entry of entries) {
+    if (prefix && !entry.gitPath.startsWith(prefix)) continue;
+    const relativeGitPath = prefix ? entry.gitPath.slice(prefix.length) : entry.gitPath;
+    const segments = relativeGitPath.split("/");
+    if (relativeGitPath === "" || relativeGitPath.startsWith("/") || segments.some((segment) => segment === "" || segment === "." || segment === "..")) continue;
+    const relativePath = segments.join(separator);
+    if (path4.isAbsolute(relativePath)) continue;
+    statuses.push({ path: relativePath, status: entry.status });
+  }
+  return statuses;
+}
+function classifyGitStatus(statusPair) {
+  if (statusPair === "??") return "untracked";
+  if (UNMERGED_STATUS_PAIRS.has(statusPair)) return "modified";
+  if (statusPair.includes("D")) return "deleted";
+  if ([...statusPair].some((status) => status === "A" || status === "M" || status === "R" || status === "C" || status === "T")) {
+    return "modified";
+  }
+  return null;
+}
+function executeGit(args, options) {
+  return new Promise((resolve, reject) => {
+    execFile(
+      "git",
+      [...args],
+      {
+        encoding: "utf8",
+        env: options.env,
+        killSignal: options.killSignal,
+        maxBuffer: options.maxBuffer,
+        shell: false,
+        timeout: options.timeout,
+        windowsHide: true
+      },
+      (error, stdout) => {
+        if (error) {
+          reject(error);
+          return;
+        }
+        resolve(stdout);
+      }
+    );
+  });
+}
+function sanitizeGitEnvironment(environment) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(environment)) {
+    if (key.toUpperCase().startsWith("GIT_")) continue;
+    if (value !== void 0) sanitized[key] = value;
+  }
+  sanitized.GIT_OPTIONAL_LOCKS = "0";
+  return sanitized;
+}
+function stripTrailingLineBreak(output) {
+  if (!output.endsWith("\n")) return output;
+  const withoutLineFeed = output.slice(0, -1);
+  return withoutLineFeed.endsWith("\r") ? withoutLineFeed.slice(0, -1) : withoutLineFeed;
+}
+function mapFsError2(error) {
+  const code = error.code;
+  if (code === "EACCES" || code === "EPERM") return new GitStatusPathError("forbidden");
+  if (code === "ENOENT" || code === "ENOTDIR") return new GitStatusPathError("not_found");
+  return new GitStatusPathError("invalid_path");
+}
 var ImageServeError = class extends Error {
   code;
   constructor(code) {
@@ -258,17 +511,17 @@ var IMAGE_SECURITY_HEADERS = {
   "Cache-Control": "private, no-store"
 };
 async function readImageForTheater(theaterPath, relativePath) {
-  const resolved = path2.resolve(theaterPath, relativePath);
+  const resolved = path4.resolve(theaterPath, relativePath);
   if (!isWithinRoot2(resolved, theaterPath)) throw new ImageServeError("path_outside_theater");
-  const ext = path2.extname(resolved).toLowerCase();
+  const ext = path4.extname(resolved).toLowerCase();
   const mimeType = MIME_ALLOWLIST[ext];
   if (!mimeType) throw new ImageServeError("mime_not_allowed");
   let realResolved;
   let realRoot;
   try {
     [realResolved, realRoot] = await Promise.all([
-      fs.promises.realpath(resolved),
-      fs.promises.realpath(theaterPath)
+      fs3.promises.realpath(resolved),
+      fs3.promises.realpath(theaterPath)
     ]);
   } catch (error) {
     const code = error.code;
@@ -278,7 +531,7 @@ async function readImageForTheater(theaterPath, relativePath) {
   if (!isWithinRoot2(realResolved, realRoot)) throw new ImageServeError("path_outside_theater");
   let stat;
   try {
-    stat = await fs.promises.stat(realResolved);
+    stat = await fs3.promises.stat(realResolved);
   } catch (error) {
     const code = error.code;
     if (code === "EACCES" || code === "EPERM") throw new ImageServeError("forbidden");
@@ -286,7 +539,7 @@ async function readImageForTheater(theaterPath, relativePath) {
   }
   if (!stat.isFile()) throw new ImageServeError("not_a_file");
   if (stat.size > IMAGE_SIZE_CAP) throw new ImageServeError("size_exceeded");
-  const buffer = await fs.promises.readFile(realResolved);
+  const buffer = await fs3.promises.readFile(realResolved);
   return { mimeType, buffer };
 }
 function writeImageResponse(res, result) {
@@ -298,13 +551,65 @@ function writeImageResponse(res, result) {
   res.end(result.buffer);
 }
 function isWithinRoot2(resolved, root) {
-  const normalizedRoot = root.endsWith(path2.sep) ? root : root + path2.sep;
+  const normalizedRoot = root.endsWith(path4.sep) ? root : root + path4.sep;
   return resolved === root || resolved.startsWith(normalizedRoot);
 }
+var FileActionUnavailableError = class extends Error {
+  constructor() {
+    super("action_unavailable");
+    this.name = "FileActionUnavailableError";
+  }
+};
+var DEFAULT_DEPENDENCIES2 = {
+  platform: process.platform,
+  launch: spawnDetached
+};
+async function revealPath(theaterPath, relativePath, mode, dependencies = {}) {
+  const deps = { ...DEFAULT_DEPENDENCIES2, ...dependencies };
+  const { realPath } = await resolveContainedActionPath(theaterPath, relativePath);
+  const command = resolveRevealCommand(deps.platform, mode, realPath);
+  if (!command) throw new FileActionUnavailableError();
+  try {
+    await deps.launch(command.file, command.args);
+  } catch (error) {
+    if (error.code === "ENOENT") throw new FileActionUnavailableError();
+    throw error;
+  }
+}
+function resolveRevealCommand(platform, mode, absolutePath) {
+  if (platform === "darwin") {
+    return mode === "reveal" ? { file: "open", args: ["-R", absolutePath] } : { file: "open", args: [absolutePath] };
+  }
+  if (platform === "linux") {
+    return {
+      file: "xdg-open",
+      args: [mode === "reveal" ? path4.dirname(absolutePath) : absolutePath]
+    };
+  }
+  if (platform === "win32") {
+    return mode === "reveal" ? { file: "explorer", args: [`/select,${absolutePath}`] } : { file: "explorer", args: [absolutePath] };
+  }
+  return null;
+}
+function spawnDetached(file, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, [...args], {
+      detached: true,
+      shell: false,
+      stdio: "ignore",
+      windowsHide: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
 var DEBOUNCE_MS = 200;
 var LINUX_DIRECTORY_WATCH_CAP = 1024;
 var watcherRegistry = createWatcherRegistry();
-function createWatcherRegistry(watcherFactory = (p, opts, cb) => fs.watch(p, opts, (ev, fn) => cb(ev, typeof fn === "string" ? fn : null)), debounceMs = DEBOUNCE_MS, platform = process.platform) {
+function createWatcherRegistry(watcherFactory = (p, opts, cb) => fs3.watch(p, opts, (ev, fn) => cb(ev, typeof fn === "string" ? fn : null)), debounceMs = DEBOUNCE_MS, platform = process.platform) {
   const entries = /* @__PURE__ */ new Map();
   function scheduleChange(entry, relDir) {
     const pending = entry.debounceTimers.get(relDir);
@@ -355,7 +660,7 @@ function createWatcherRegistry(watcherFactory = (p, opts, cb) => fs.watch(p, opt
     }
   }
   function invalidateWatcherTree(entry, watchKey) {
-    const descendantPrefix = watchKey + path2.sep;
+    const descendantPrefix = watchKey + path4.sep;
     for (const [candidateKey, candidateWatcher] of entry.watchers) {
       if (candidateKey !== watchKey && !candidateKey.startsWith(descendantPrefix)) continue;
       entry.watchers.delete(candidateKey);
@@ -371,7 +676,7 @@ function createWatcherRegistry(watcherFactory = (p, opts, cb) => fs.watch(p, opt
     let identityCheckRunning = false;
     let identityCheckRequested = false;
     let activeWatcher = null;
-    const lexicalWatchPath = path2.resolve(entry.theaterPath, watchKey);
+    const lexicalWatchPath = path4.resolve(entry.theaterPath, watchKey);
     const checkDirectoryIdentity = async (expectedWatcher) => {
       identityCheckRequested = true;
       if (identityCheckRunning || !watchIdentity) return;
@@ -381,7 +686,7 @@ function createWatcherRegistry(watcherFactory = (p, opts, cb) => fs.watch(p, opt
           identityCheckRequested = false;
           let replaced = false;
           try {
-            const stats = await fs.promises.stat(lexicalWatchPath);
+            const stats = await fs3.promises.stat(lexicalWatchPath);
             replaced = stats.dev !== watchIdentity.device || stats.ino !== watchIdentity.inode;
           } catch (error) {
             replaced = error.code === "ENOENT";
@@ -403,7 +708,7 @@ function createWatcherRegistry(watcherFactory = (p, opts, cb) => fs.watch(p, opt
       if (!entry.recursive && event === "rename") {
         if (watchKey !== "" && watchIdentity) void checkDirectoryIdentity(currentWatcher);
         if (filename) {
-          const changedChildKey = path2.join(watchKey, filename);
+          const changedChildKey = path4.join(watchKey, filename);
           entry.identityChecks.get(changedChildKey)?.();
         }
       }
@@ -507,16 +812,16 @@ function createWatcherRegistry(watcherFactory = (p, opts, cb) => fs.watch(p, opt
   return { subscribe, trackDirectory };
 }
 async function resolveTrackedDirectory(theaterPath, relativePath) {
-  const resolvedRoot = path2.resolve(theaterPath);
-  const targetPath = path2.resolve(resolvedRoot, relativePath);
+  const resolvedRoot = path4.resolve(theaterPath);
+  const targetPath = path4.resolve(resolvedRoot, relativePath);
   if (!isWithinRoot3(targetPath, resolvedRoot)) return null;
   try {
     const [realRoot, realTarget] = await Promise.all([
-      fs.promises.realpath(theaterPath),
-      fs.promises.realpath(targetPath)
+      fs3.promises.realpath(theaterPath),
+      fs3.promises.realpath(targetPath)
     ]);
     if (!isWithinRoot3(realTarget, realRoot)) return null;
-    const stats = await fs.promises.stat(realTarget);
+    const stats = await fs3.promises.stat(realTarget);
     if (!stats.isDirectory()) return null;
     return {
       path: realTarget,
@@ -527,7 +832,7 @@ async function resolveTrackedDirectory(theaterPath, relativePath) {
   }
 }
 function isWithinRoot3(candidate, root) {
-  const normalizedRoot = root.endsWith(path2.sep) ? root : root + path2.sep;
+  const normalizedRoot = root.endsWith(path4.sep) ? root : root + path4.sep;
   return candidate === root || candidate.startsWith(normalizedRoot);
 }
 function computeRelDir(filename) {
@@ -538,6 +843,8 @@ function computeRelDir(filename) {
 }
 
 // ../fleet-plugins/file-explorer/server/handlers.ts
+var DEFAULT_CLIPBOARD_DEPENDENCIES = { copyPath: copyPathToClipboard };
+var DEFAULT_REVEAL_DEPENDENCIES = { revealPath };
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -587,6 +894,36 @@ async function handleFilesList(req, res, ctx) {
     throw error;
   }
 }
+async function handleFilesGitStatus(req, res, ctx) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const body = await ctx.host.http.readJsonBody(req);
+  if (!isPlainObject(body) || typeof body.theaterId !== "string") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const theaterPath = ctx.host.paths.resolveTheaterPath(body.theaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  try {
+    ctx.host.http.writeJson(res, 200, await readTheaterGitStatus(theaterPath));
+  } catch (error) {
+    if (error instanceof GitStatusPathError) {
+      const httpStatus = error.code === "forbidden" ? 403 : error.code === "not_found" ? 404 : 400;
+      ctx.host.http.writeJson(res, httpStatus, { error: error.code });
+      return;
+    }
+    throw error;
+  }
+}
 async function handleFilesRead(req, res, ctx) {
   if (req.method !== "POST") {
     ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
@@ -660,6 +997,74 @@ async function handleFilesImage(req, res, ctx) {
     throw error;
   }
 }
+async function handleFilesClipboard(req, res, ctx, dependencies = DEFAULT_CLIPBOARD_DEPENDENCIES) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const body = await ctx.host.http.readJsonBody(req);
+  if (!isPlainObject(body) || typeof body.theaterId !== "string" || typeof body.relativePath !== "string") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const theaterPath = ctx.host.paths.resolveTheaterPath(body.theaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  try {
+    await dependencies.copyPath(theaterPath, body.relativePath);
+    writeNoContent(res);
+  } catch (error) {
+    if (error instanceof PathActionError) {
+      writePathActionError(res, ctx, error);
+      return;
+    }
+    if (error instanceof ClipboardUnavailableError) {
+      ctx.host.http.writeJson(res, 501, { error: "clipboard_unavailable" });
+      return;
+    }
+    ctx.host.http.writeJson(res, 500, { error: "clipboard_failed" });
+  }
+}
+async function handleFilesReveal(req, res, ctx, dependencies = DEFAULT_REVEAL_DEPENDENCIES) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const body = await ctx.host.http.readJsonBody(req);
+  if (!isPlainObject(body) || typeof body.theaterId !== "string" || typeof body.relativePath !== "string" || !isFileRevealMode(body.mode)) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const theaterPath = ctx.host.paths.resolveTheaterPath(body.theaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  try {
+    await dependencies.revealPath(theaterPath, body.relativePath, body.mode);
+    writeNoContent(res);
+  } catch (error) {
+    if (error instanceof PathActionError) {
+      writePathActionError(res, ctx, error);
+      return;
+    }
+    if (error instanceof FileActionUnavailableError) {
+      ctx.host.http.writeJson(res, 501, { error: "action_unavailable" });
+      return;
+    }
+    ctx.host.http.writeJson(res, 500, { error: "action_failed" });
+  }
+}
 function handleFilesWatch(req, res, ctx) {
   if (req.method !== "GET") {
     ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
@@ -711,10 +1116,21 @@ data: ${data}
     }
   });
 }
+function isFileRevealMode(value) {
+  return value === "reveal" || value === "open";
+}
+function writeNoContent(res) {
+  res.statusCode = 204;
+  res.end();
+}
+function writePathActionError(res, ctx, error) {
+  const status = error.code === "not_found" ? 404 : 403;
+  ctx.host.http.writeJson(res, status, { error: error.code });
+}
 var SEARCH_DIRECTORY_CAP = 500;
 var SEARCH_ENTRY_CAP = 25e3;
 async function searchTheaterFiles(theaterPath, query, limit) {
-  const realRoot = await fs5.realpath(theaterPath);
+  const realRoot = await fs8.realpath(theaterPath);
   const tokens = query.trim().toLocaleLowerCase().split(/\s+/).filter(Boolean);
   const pending = [{ absolutePath: realRoot, relativePath: "" }];
   const visited = /* @__PURE__ */ new Set();
@@ -728,7 +1144,7 @@ async function searchTheaterFiles(theaterPath, query, limit) {
     directoryCount += 1;
     let entries;
     try {
-      entries = await fs5.readdir(directory.absolutePath, { withFileTypes: true });
+      entries = await fs8.readdir(directory.absolutePath, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -737,14 +1153,14 @@ async function searchTheaterFiles(theaterPath, query, limit) {
       if (entryCount >= SEARCH_ENTRY_CAP) break;
       entryCount += 1;
       const relativePath = directory.relativePath ? `${directory.relativePath}/${entry.name}` : entry.name;
-      const absolutePath = path2.join(directory.absolutePath, entry.name);
+      const absolutePath = path4.join(directory.absolutePath, entry.name);
       let kind = entry.isDirectory() ? "dir" : entry.isFile() ? "file" : null;
       let realPath = absolutePath;
       if (entry.isSymbolicLink()) {
         try {
-          realPath = await fs5.realpath(absolutePath);
+          realPath = await fs8.realpath(absolutePath);
           if (!isContained(realRoot, realPath)) continue;
-          const stat = await fs5.stat(realPath);
+          const stat = await fs8.stat(realPath);
           kind = stat.isDirectory() ? "dir" : stat.isFile() ? "file" : null;
         } catch {
           continue;
@@ -797,8 +1213,8 @@ function compareFileSearchItem(left, right, query) {
   return leftRank - rightRank || left.relativePath.localeCompare(right.relativePath);
 }
 function isContained(root, candidate) {
-  const relative = path2.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
+  const relative = path4.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative);
 }
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -812,6 +1228,10 @@ var routes_default = definePlugin({
       await handleFilesList(req, res, ctx);
       return true;
     });
+    registerRouter(ctx, "files/git-status", async ({ req, res }) => {
+      await handleFilesGitStatus(req, res, ctx);
+      return true;
+    });
     registerRouter(ctx, "files/read", async ({ req, res }) => {
       await handleFilesRead(req, res, ctx);
       return true;
@@ -820,6 +1240,14 @@ var routes_default = definePlugin({
       await handleFilesImage(req, res, ctx);
       return true;
     });
+    registerRouter(ctx, "files/clipboard", async ({ req, res }) => {
+      await handleFilesClipboard(req, res, ctx);
+      return true;
+    });
+    registerRouter(ctx, "files/reveal", async ({ req, res }) => {
+      await handleFilesReveal(req, res, ctx);
+      return true;
+    });
     registerRouter(ctx, "files/watch", ({ req, res }) => {
       handleFilesWatch(req, res, ctx);
       return true;