@genspark/cli 1.0.15 → 1.0.16

package/dist/commands/design.js

@@ -0,0 +1,990 @@
+/**
+ * `gsk design [path]` — local cc-bridge daemon for Genspark Designer V2 / V3.
+ *
+ * Hosts two HTTP servers on 127.0.0.1, mirroring the protocol Tiffany's
+ * private Anthropic CC binary speaks to claude.ai/design. Once the URL is
+ * opened in the user's browser, the FE side of cc-bridge (see
+ * `frontend-nuxt/utils/cc_bridge.ts`) redeems the nonce, registers the 6
+ * cc_* tool handlers in the client-tool dispatcher, and dispatches LLM
+ * tool calls over this bridge.
+ *
+ * Servers:
+ *   - Exchange: port 47820 (well-known), POST /exchange {nonce} →
+ *     {port, token, prompt, cwd, ls_tree}. Single-use — second hit on
+ *     the same nonce returns 410 Gone.
+ *   - Data: random port, bearer-authenticated routes
+ *     /ls /read /grep /exec /back_to_cc /context. Auth = Authorization:
+ *     Bearer + X-Bridge-Token (both headers must match the issued token,
+ *     to force a fetch/CORS preflight and block <form>/<img> CSRF).
+ *
+ * Security:
+ *   - Bind 127.0.0.1 only — never 0.0.0.0.
+ *   - Origin allowlist enforced via CORS preflight (`https://www.genspark.ai`
+ *     + `http://localhost:3000-3099` for dev).
+ *   - Host header strict-check: must be `127.0.0.1:<port>` or
+ *     `localhost:<port>` — blocks DNS rebinding.
+ *   - Path inputs are normalized + rejected on `..`, absolute paths,
+ *     NUL bytes. Symlink escape blocked via realpath check.
+ *   - cc_exec allowlist defaults to read-only inspection commands;
+ *     `--allow-build-tools` opens up build CLIs (git/npm/python/etc).
+ *     Per-arg blocklist refuses `-c`, `--exec`, shell metacharacters
+ *     and newlines regardless of allowlist.
+ *   - 30s exec timeout (overridable per call up to 300s), 900 KB
+ *     stdout/stderr cap, 5 req/sec rate limit on /exec.
+ */
+import * as crypto from 'crypto';
+import { spawn } from 'child_process';
+import * as fs from 'fs';
+import * as fsp from 'fs/promises';
+import * as http from 'http';
+import * as os from 'os';
+import * as path from 'path';
+import { debug, info, error as logError, output } from '../logger.js';
+// ---------------------------------------------------------------------------
+// Protocol constants — keep aligned with
+// `backend/tool_call/designer2/cc_bridge_protocol.py` and
+// `frontend-nuxt/utils/ccBridgeConstants.ts`. These three files form the
+// parity contract; a drift in any one of them is a wire-level bug.
+// ---------------------------------------------------------------------------
+const EXCHANGE_PORT = 47820;
+const DEFAULT_LAUNCH_URL = 'https://www.genspark.ai/agents?type=design';
+const DEFAULT_EXEC_ALLOWLIST = [
+    'ls',
+    'cat',
+    'pwd',
+    'echo',
+    'head',
+    'tail',
+    'wc',
+    'file',
+    'which',
+    'date',
+    'hostname',
+    'uname',
+];
+const BUILD_TOOLS_ALLOWLIST = [
+    'git',
+    'npm',
+    'pnpm',
+    'yarn',
+    'node',
+    'python',
+    'python3',
+    'pip',
+    'pip3',
+    'rg',
+    'grep',
+    'find',
+    'cargo',
+    'go',
+];
+// Per-arg blocklist for cc_exec. The earlier "global short-flag"
+// blocklist (`-m`/`-r`/`-e`/`-p`) was too broad: those flags are
+// legitimate for `git commit -m`, `grep -r`, `grep -e`, `git log -p`,
+// etc. (Bugbot round 8 Medium). Switched to per-cmd dispatch — only
+// the interpreters that actually accept those flags as inline-code
+// shorthand pay the cost.
+//
+// Universal restrictions (any command, any arg):
+//   - Shell metacharacters that escape into a sub-shell.
+//   - `--exec` / `--inspect*` / `--upload-pack` / `--receive-pack`
+//     are interpreter-shaped flags that broadly enable code paths
+//     dangerous everywhere (e.g. `git --upload-pack='evil cmd' ...`).
+const UNIVERSAL_BAD_ARG_RE = /^--exec(?:$|[=\-])|^--inspect|^--upload-pack|^--receive-pack|[;&|`$<>\n\r]/;
+// Per-command blocklist. The values are exact short flags + an
+// optional regex for long flags / prefix matches. A match → reject
+// the arg. `longFlagRe` is omitted (rather than `/^$/`) for commands
+// with no long-flag rules — `/^$/` would match the empty string,
+// which is technically valid but semantically confusing (Bugbot
+// round 11 Medium).
+const PER_CMD_BAD_ARGS = {
+    // Bash/sh/zsh — `-c` runs an inline command string. The default
+    // allowlist doesn't even include bash, but a future --allow flag
+    // might, and bash is the most common smuggling vector.
+    bash: { shortFlags: new Set(['-c']), longFlagRe: /^--command/ },
+    sh: { shortFlags: new Set(['-c']), longFlagRe: /^--command/ },
+    zsh: { shortFlags: new Set(['-c']), longFlagRe: /^--command/ },
+    fish: { shortFlags: new Set(['-c']), longFlagRe: /^--command/ },
+    // Python — `-c` inline, `-m` runs a module by name (still arbitrary
+    // code), `-eval` not real but cheap to block. `--command` exists
+    // on some wrappers.
+    python: {
+        shortFlags: new Set(['-c', '-m']),
+        longFlagRe: /^--command/,
+    },
+    python3: {
+        shortFlags: new Set(['-c', '-m']),
+        longFlagRe: /^--command/,
+    },
+    // Node — `-e` (eval), `-p` (print = eval+print), `-r` (require)
+    // are all code execution. `--eval` / `--print` / `--require` are
+    // the long forms; `--inspect*` is universally blocked above.
+    node: {
+        shortFlags: new Set(['-e', '-p', '-r']),
+        longFlagRe: /^--(?:eval|print|require)/,
+    },
+    // Find — `-exec` / `-execdir` run arbitrary commands per match,
+    // `-delete` mass-removes. `-ok` is interactive but still exec.
+    // `find` has no `--`-prefixed dangerous flags (the dangerous ones
+    // are all single-dash); `longFlagRe` is omitted to mean "no extra
+    // long-flag matching".
+    find: {
+        shortFlags: new Set([
+            '-exec',
+            '-execdir',
+            '-delete',
+            '-ok',
+            '-okdir',
+            '-fprint',
+            '-fprintf',
+        ]),
+    },
+    // Git — `-c <key>=<val>` can override `core.sshCommand`,
+    // `core.fsmonitor`, `core.pager`, etc. to run arbitrary commands
+    // during otherwise-safe git operations. `--exec-path` /
+    // `--upload-pack` / `--receive-pack` are caught by the universal
+    // regex; `-c` is short-flag and needs an explicit per-cmd entry
+    // (Bugbot round 15 Medium). The `longFlagRe` here doubles as a
+    // "starts with `-c`" check so the concatenated form `-ckey=val`
+    // (which git also accepts) is caught — Bugbot round 21 Medium.
+    // `^-c(?:[=A-Za-z].*)?$` matches `-c`, `-c=foo`, `-cfoo` but not
+    // `-cmd` (which isn't a real git flag anyway). The exact `-c` is
+    // already in shortFlags; this regex catches the suffix-attached
+    // variants.
+    git: {
+        shortFlags: new Set(['-c']),
+        longFlagRe: /^-c[=A-Za-z]/,
+    },
+};
+function _argIsSafeForCmd(cmd, arg) {
+    if (typeof arg !== 'string')
+        return false;
+    if (arg.includes('\0'))
+        return false;
+    if (UNIVERSAL_BAD_ARG_RE.test(arg))
+        return false;
+    const rules = PER_CMD_BAD_ARGS[cmd];
+    if (rules) {
+        if (rules.shortFlags.has(arg))
+            return false;
+        if (rules.longFlagRe && rules.longFlagRe.test(arg))
+            return false;
+    }
+    return true;
+}
+const EXEC_DEFAULT_TIMEOUT_S = 30;
+const EXEC_MAX_TIMEOUT_S = 300;
+const EXEC_OUTPUT_CAP = 900 * 1024; // 900K
+const EXEC_RATE_LIMIT_PER_SEC = 5;
+const READ_DEFAULT_LIMIT = 2000;
+const READ_HARD_LIMIT = 1_000_000;
+const LS_DEFAULT_DEPTH = 2;
+const LS_MAX_DEPTH = 6;
+const LS_DEFAULT_IGNORE = [
+    '.git',
+    'node_modules',
+    '.next',
+    '.nuxt',
+    'dist',
+    'build',
+    '__pycache__',
+    '.venv',
+    'venv',
+    '.cache',
+    'target',
+];
+// Exact-match origin list — `startsWith` would let
+// `https://genspark.ai.evil.com` match and bypass the allowlist. Each
+// entry must equal `req.headers.origin` byte-for-byte (which is how
+// browsers emit Origin headers — no trailing slash).
+const ALLOWED_ORIGINS = new Set([
+    'https://www.genspark.ai',
+    'https://genspark.ai',
+]);
+// Localhost is allowed at any port for dev. `^…$` anchors prevent
+// suffix-injection (e.g. http://localhost:3000.evil.com).
+const LOCALHOST_ORIGIN_RE = /^http:\/\/localhost:\d+$/;
+function newState(opts) {
+    let finished = () => { };
+    const finishedPromise = new Promise(r => {
+        finished = r;
+    });
+    const allow = new Set(DEFAULT_EXEC_ALLOWLIST);
+    if (opts.allowBuildTools) {
+        for (const c of BUILD_TOOLS_ALLOWLIST)
+            allow.add(c);
+    }
+    return {
+        cwd: opts.cwd,
+        prompt: opts.prompt,
+        port: 0,
+        token: crypto.randomBytes(32).toString('hex'),
+        nonce: crypto.randomBytes(32).toString('hex'),
+        lsTree: '',
+        closed: false,
+        execAllowlist: allow,
+        execHits: [],
+        exchangeServer: null,
+        dataServer: null,
+        finished,
+        finishedPromise,
+    };
+}
+// ---------------------------------------------------------------------------
+// Path / arg safety
+// ---------------------------------------------------------------------------
+function resolveInsideCwd(rel, cwd) {
+    if (typeof rel !== 'string')
+        return { ok: false, reason: 'path must be string' };
+    if (rel.includes('\0'))
+        return { ok: false, reason: 'NUL in path' };
+    if (path.isAbsolute(rel))
+        return { ok: false, reason: 'absolute path' };
+    const parts = rel.split(/[\\/]/);
+    if (parts.some(p => p === '..'))
+        return { ok: false, reason: 'traversal segment' };
+    const abs = path.resolve(cwd, rel);
+    const cwdRoot = cwd.endsWith(path.sep) ? cwd : cwd + path.sep;
+    if (abs !== cwd && !abs.startsWith(cwdRoot)) {
+        return { ok: false, reason: 'resolves outside cwd' };
+    }
+    return { ok: true, abs };
+}
+async function realpathInsideCwd(abs, cwd) {
+    try {
+        const realCwd = await fsp.realpath(cwd);
+        const realAbs = await fsp.realpath(abs);
+        const root = realCwd.endsWith(path.sep) ? realCwd : realCwd + path.sep;
+        return realAbs === realCwd || realAbs.startsWith(root);
+    }
+    catch {
+        return false;
+    }
+}
+// ---------------------------------------------------------------------------
+// FS helpers
+// ---------------------------------------------------------------------------
+async function lsTree(rootAbs, cwd, depth) {
+    const out = [];
+    async function walk(dirAbs, dirRel, d) {
+        let entries;
+        try {
+            entries = await fsp.readdir(dirAbs, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (LS_DEFAULT_IGNORE.includes(e.name))
+                continue;
+            const childRel = dirRel ? `${dirRel}/${e.name}` : e.name;
+            out.push(e.isDirectory() ? childRel + '/' : childRel);
+            if (e.isDirectory() && d > 1) {
+                await walk(path.join(dirAbs, e.name), childRel, d - 1);
+            }
+        }
+    }
+    // Compute initial relative dir from absolute.
+    const initialRel = rootAbs === cwd ? '' : path.relative(cwd, rootAbs);
+    await walk(rootAbs, initialRel, Math.max(1, Math.min(depth, LS_MAX_DEPTH)));
+    return out;
+}
+function isBinaryHeuristic(buf) {
+    const n = Math.min(buf.length, 8192);
+    for (let i = 0; i < n; i++)
+        if (buf[i] === 0)
+            return true;
+    return false;
+}
+// Hard cap on /read regardless of binary or text — without this, a
+// multi-GB file in the user's cwd would OOM the daemon during the
+// initial `fsp.readFile` call (loads the entire file into a Buffer
+// before any heuristic runs). We `fs.stat` first and refuse oversized
+// files outright; for binary, the on-disk cap also bounds the base64
+// blowup (1.33×) on the response side.
+const READ_FILE_HARD_CAP_BYTES = 50 * 1024 * 1024; // 50 MB
+const BINARY_READ_CAP_BYTES = 10 * 1024 * 1024; // 10 MB
+async function readFileSlice(abs, offset, limit) {
+    // Size gate before reading. `fs.stat` is cheap and avoids the
+    // round-trip where `fs.readFile` happily loads 4 GB before the cap
+    // check fires. Throwing here lands as the 400 response in the
+    // handler's try/catch — same shape as a permission denied read.
+    const stat = await fsp.stat(abs);
+    if (stat.size > READ_FILE_HARD_CAP_BYTES) {
+        throw new Error(`file exceeds ${READ_FILE_HARD_CAP_BYTES} bytes (${stat.size}) — too large to read`);
+    }
+    const buf = await fsp.readFile(abs);
+    if (isBinaryHeuristic(buf)) {
+        if (buf.length > BINARY_READ_CAP_BYTES) {
+            // Return the first BINARY_READ_CAP_BYTES so the LLM at least
+            // gets a head, with the truncation flag set. Mirrors cc_read's
+            // standard contract for text files that exceed line cap.
+            return {
+                binary: true,
+                truncated: true,
+                base64: buf.subarray(0, BINARY_READ_CAP_BYTES).toString('base64'),
+            };
+        }
+        return { binary: true, truncated: false, base64: buf.toString('base64') };
+    }
+    const text = buf.toString('utf8');
+    const lines = text.split('\n');
+    const end = Math.min(lines.length, offset + limit);
+    const slice = lines.slice(offset, end).join('\n');
+    return {
+        binary: false,
+        truncated: end < lines.length || lines.length > READ_HARD_LIMIT,
+        content: slice,
+    };
+}
+// Pattern-length cap on grep — defense against ReDoS via
+// catastrophic-backtracking patterns like `(a+)+$`. JS regex is
+// synchronous and can hang the event loop indefinitely on a
+// pathological pattern (Bugbot round 9 Medium). Combined with the
+// nested-quantifier rejection below and the per-grep walltime budget,
+// this bounds the damage. Long-term proper fix is to shell out to
+// ripgrep (linear-time engine), but that adds a runtime dependency.
+const GREP_PATTERN_MAX_LEN = 200;
+// Reject `(<anything-with-*-or-+>)+` and `(<…>)*` shapes — the
+// classic ReDoS catastrophic-backtracking signature. Not exhaustive
+// but catches the common attack patterns.
+const GREP_NESTED_QUANT_RE = /\([^)]*[+*][^)]*\)[+*]/;
+// Total wall-clock budget for one /grep call. We bail out of the
+// file walk past this point even if matches < 200; protects against
+// "many small ReDoS-vulnerable files" attacks.
+const GREP_TOTAL_BUDGET_MS = 5000;
+async function grepFiles(cwd, pattern, subdir, glob) {
+    if (pattern.length > GREP_PATTERN_MAX_LEN) {
+        throw new Error(`pattern exceeds ${GREP_PATTERN_MAX_LEN} chars`);
+    }
+    if (GREP_NESTED_QUANT_RE.test(pattern)) {
+        throw new Error('pattern contains nested quantifiers (ReDoS-prone) — rewrite without nested * / + inside groups');
+    }
+    const startRel = subdir || '';
+    const start = resolveInsideCwd(startRel || '.', cwd);
+    if (!start.ok)
+        throw new Error(start.reason);
+    // Symlink-escape check on the search root — without this, a symlink
+    // under cwd pointing at /etc would let an LLM-supplied `path` arg
+    // smuggle a grep against system files. /ls and /read enforce the
+    // same check; keep them in sync.
+    if (!(await realpathInsideCwd(start.abs, cwd))) {
+        throw new Error('symlink escapes cwd');
+    }
+    let regex;
+    try {
+        regex = new RegExp(pattern);
+    }
+    catch (e) {
+        throw new Error(`bad regex: ${e.message}`);
+    }
+    const deadline = Date.now() + GREP_TOTAL_BUDGET_MS;
+    const globRe = glob
+        ? new RegExp('^' + glob.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$')
+        : null;
+    const matches = [];
+    async function walk(dirAbs, dirRel) {
+        if (matches.length >= 200)
+            return;
+        if (Date.now() > deadline)
+            return;
+        let entries;
+        try {
+            entries = await fsp.readdir(dirAbs, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (Date.now() > deadline)
+                return;
+            if (LS_DEFAULT_IGNORE.includes(e.name))
+                continue;
+            const rel = dirRel ? `${dirRel}/${e.name}` : e.name;
+            const abs = path.join(dirAbs, e.name);
+            if (e.isDirectory()) {
+                await walk(abs, rel);
+            }
+            else if (e.isFile()) {
+                if (globRe && !globRe.test(e.name))
+                    continue;
+                try {
+                    // Stat-gate the read — without this, grep walks a 4 GB
+                    // database dump straight into memory (Bugbot round 4 Low).
+                    // `/read` enforces the same cap explicitly; mirror that
+                    // here. Skip silently rather than abort the whole grep
+                    // because the LLM doesn't care about giant blobs anyway.
+                    const stat = await fsp.stat(abs);
+                    if (stat.size > READ_FILE_HARD_CAP_BYTES)
+                        continue;
+                    const buf = await fsp.readFile(abs);
+                    if (isBinaryHeuristic(buf))
+                        continue;
+                    const lines = buf.toString('utf8').split('\n');
+                    for (let i = 0; i < lines.length && matches.length < 200; i++) {
+                        if (regex.test(lines[i])) {
+                            matches.push(`${rel}:${i + 1}: ${lines[i].slice(0, 200)}`);
+                        }
+                    }
+                }
+                catch {
+                    // unreadable file — skip
+                }
+            }
+            if (matches.length >= 200)
+                return;
+        }
+    }
+    await walk(start.abs, startRel);
+    return matches;
+}
+// ---------------------------------------------------------------------------
+// HTTP helpers
+// ---------------------------------------------------------------------------
+function send(res, status, body, origin) {
+    // CORS must travel on the real response too — preflight OPTIONS only
+    // covers the predicate; the browser blocks the actual body if
+    // `Access-Control-Allow-Origin` is missing on the POST response.
+    // Without this every cc_* tool call from the browser ends in a CORS
+    // failure even though preflight succeeded. Caller passes
+    // `req.headers.origin` so we echo a single trusted origin rather
+    // than `*` (which Chrome rejects when combined with credentials).
+    res.writeHead(status, {
+        'Content-Type': 'application/json',
+        ...corsHeaders(origin),
+    });
+    res.end(JSON.stringify(body));
+}
+function corsHeaders(origin) {
+    const allow = origin && originAllowed(origin) ? origin : '';
+    // First default origin acts as a "no echo" fallback so the header is
+    // always present (some browsers cache a no-CORS response harder than
+    // a wrong-origin response).
+    return {
+        'Access-Control-Allow-Origin': allow || 'https://www.genspark.ai',
+        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+        'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Bridge-Token',
+        'Access-Control-Max-Age': '600',
+        // PNA (Private Network Access) — Chrome 117+ requires this on cross-origin
+        // requests targeting localhost. Without it the browser blocks the
+        // preflight with `ERR_FAILED` and no useful console message.
+        'Access-Control-Allow-Private-Network': 'true',
+    };
+}
+function originAllowed(origin) {
+    if (!origin)
+        return false;
+    if (ALLOWED_ORIGINS.has(origin))
+        return true;
+    if (LOCALHOST_ORIGIN_RE.test(origin))
+        return true;
+    return false;
+}
+function hostAllowed(host, port) {
+    if (!host)
+        return false;
+    return host === `127.0.0.1:${port}` || host === `localhost:${port}`;
+}
+// Body cap on incoming /back_to_cc payloads. The BE's
+// `cc_bridge_export` endpoint allows up to 50 MB of *decoded* file
+// bytes; base64 wrapping inflates that ~33% → ~67 MB on the wire.
+// Add ~33% headroom on top of that for the surrounding JSON shape
+// (paths, prompt, framing). Previously 50 MB which got rejected for
+// any export with > ~37 MB of decoded content (Bugbot round 10
+// Medium).
+const DAEMON_BODY_CAP_BYTES = 96 * 1024 * 1024;
+async function readJsonBody(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const c of req) {
+        const buf = c;
+        total += buf.length;
+        if (total > DAEMON_BODY_CAP_BYTES)
+            throw new Error('body too large');
+        chunks.push(buf);
+    }
+    if (chunks.length === 0)
+        return {};
+    const text = Buffer.concat(chunks).toString('utf8');
+    if (!text)
+        return {};
+    return JSON.parse(text);
+}
+// ---------------------------------------------------------------------------
+// Exchange server (port 47820)
+// ---------------------------------------------------------------------------
+function startExchangeServer(state) {
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            const origin = req.headers.origin;
+            // Preflight
+            if (req.method === 'OPTIONS') {
+                res.writeHead(204, corsHeaders(origin));
+                res.end();
+                return;
+            }
+            if (!originAllowed(origin)) {
+                res.writeHead(403, corsHeaders(origin));
+                res.end(JSON.stringify({ error: 'origin not allowed' }));
+                return;
+            }
+            // Host strict-check — same DNS-rebinding defense as the data
+            // server. The exchange port is well-known (47820); a malicious
+            // page that resolves `genspark-bridge.com → 127.0.0.1` could
+            // otherwise send Origin=evil.com (origin-rejected above) — but
+            // also Origin=https://genspark.ai with `Host: rebound.com:47820`
+            // and bypass single-origin if the browser's DNS-rebound IP
+            // matches the server's bind. Defense in depth.
+            if (!hostAllowed(req.headers.host, EXCHANGE_PORT)) {
+                res.writeHead(403, corsHeaders(origin));
+                res.end(JSON.stringify({ error: 'host not allowed' }));
+                return;
+            }
+            if (req.method !== 'POST' || req.url !== '/exchange') {
+                res.writeHead(404, corsHeaders(origin));
+                res.end(JSON.stringify({ error: 'not found' }));
+                return;
+            }
+            void readJsonBody(req)
+                .then(body => {
+                const got = body.nonce;
+                if (!got || got !== state.nonce) {
+                    res.writeHead(401, corsHeaders(origin));
+                    res.end(JSON.stringify({ error: 'bad nonce' }));
+                    return;
+                }
+                // Single-use: invalidate after first redeem.
+                state.nonce = '';
+                res.writeHead(200, {
+                    'Content-Type': 'application/json',
+                    ...corsHeaders(origin),
+                });
+                res.end(JSON.stringify({
+                    port: state.port,
+                    token: state.token,
+                    prompt: state.prompt,
+                    cwd: state.cwd,
+                    ls_tree: state.lsTree,
+                }));
+            })
+                .catch(() => {
+                res.writeHead(400, corsHeaders(origin));
+                res.end(JSON.stringify({ error: 'bad body' }));
+            });
+        });
+        server.on('error', reject);
+        server.listen(EXCHANGE_PORT, '127.0.0.1', () => {
+            state.exchangeServer = server;
+            resolve();
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// Data server (random port)
+// ---------------------------------------------------------------------------
+function startDataServer(state) {
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            void handleDataRequest(req, res, state).catch(err => {
+                try {
+                    // No closure-scoped `origin` here — read from the request
+                    // we still have a reference to.
+                    send(res, 500, { error: err.message }, req.headers.origin);
+                }
+                catch {
+                    // ignore
+                }
+            });
+        });
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (addr && typeof addr === 'object')
+                state.port = addr.port;
+            state.dataServer = server;
+            resolve();
+        });
+    });
+}
+async function handleDataRequest(req, res, state) {
+    const origin = req.headers.origin;
+    if (req.method === 'OPTIONS') {
+        res.writeHead(204, corsHeaders(origin));
+        res.end();
+        return;
+    }
+    // 4-layer auth: origin → host → bearer → custom header
+    if (!originAllowed(origin)) {
+        send(res, 403, { error: 'origin not allowed' }, origin);
+        return;
+    }
+    if (!hostAllowed(req.headers.host, state.port)) {
+        send(res, 403, { error: 'host not allowed' }, origin);
+        return;
+    }
+    if (state.closed) {
+        send(res, 410, { error: 'bridge closed' }, origin);
+        return;
+    }
+    const bearer = req.headers.authorization;
+    const xbridge = req.headers['x-bridge-token'];
+    if (!bearer || bearer !== `Bearer ${state.token}` || xbridge !== state.token) {
+        send(res, 401, { error: 'auth' }, origin);
+        return;
+    }
+    const url = req.url || '';
+    switch (url) {
+        case '/ls': {
+            const body = (await readJsonBody(req));
+            const subdir = typeof body.path === 'string' ? body.path : '';
+            const d = typeof body.depth === 'number' ? body.depth : LS_DEFAULT_DEPTH;
+            const resolved = resolveInsideCwd(subdir || '.', state.cwd);
+            if (!resolved.ok) {
+                send(res, 400, { error: resolved.reason }, origin);
+                return;
+            }
+            // Symlink-escape check (same discipline as /read): a symlink
+            // under cwd pointing at /etc would otherwise let an LLM-supplied
+            // `path` arg enumerate outside the bridge sandbox.
+            if (!(await realpathInsideCwd(resolved.abs, state.cwd))) {
+                send(res, 400, { error: 'symlink escapes cwd' }, origin);
+                return;
+            }
+            const entries = await lsTree(resolved.abs, state.cwd, d);
+            send(res, 200, { entries }, origin);
+            return;
+        }
+        case '/read': {
+            const body = (await readJsonBody(req));
+            if (!body.path) {
+                send(res, 400, { error: 'path required' }, origin);
+                return;
+            }
+            const r = resolveInsideCwd(body.path, state.cwd);
+            if (!r.ok) {
+                send(res, 400, { error: r.reason }, origin);
+                return;
+            }
+            if (!(await realpathInsideCwd(r.abs, state.cwd))) {
+                send(res, 400, { error: 'symlink escapes cwd' }, origin);
+                return;
+            }
+            // Clamp to non-negative — a negative limit / offset gives
+            // `lines.slice` undefined-behavior-looking results (e.g. limit
+            // = -1 → all-but-last line). Coerce to 0 and let the cap on
+            // the high side enforce the real bound (Bugbot round 14 Low).
+            const offsetRaw = typeof body.offset === 'number' ? body.offset : 0;
+            const limitRaw = typeof body.limit === 'number' ? body.limit : READ_DEFAULT_LIMIT;
+            const offset = Math.max(0, Math.floor(offsetRaw));
+            const limit = Math.max(0, Math.min(Math.floor(limitRaw), READ_HARD_LIMIT));
+            try {
+                const result = await readFileSlice(r.abs, offset, limit);
+                send(res, 200, result, origin);
+            }
+            catch (e) {
+                send(res, 400, { error: e.message }, origin);
+            }
+            return;
+        }
+        case '/grep': {
+            const body = (await readJsonBody(req));
+            if (!body.pattern) {
+                send(res, 400, { error: 'pattern required' }, origin);
+                return;
+            }
+            try {
+                const matches = await grepFiles(state.cwd, body.pattern, body.path || '', body.glob || '');
+                send(res, 200, { matches }, origin);
+            }
+            catch (e) {
+                send(res, 400, { error: e.message }, origin);
+            }
+            return;
+        }
+        case '/exec': {
+            // Rate limit: drop hits older than 1s, then check count.
+            // CRITICAL: bump the counter SYNCHRONOUSLY before any await — JS
+            // is single-threaded between awaits but two concurrent requests
+            // could otherwise both pass the count check (both at length=4)
+            // and then both push (→ 6 concurrent execs, busting the cap).
+            // Push first, then await body parsing.
+            const now = Date.now();
+            state.execHits = state.execHits.filter(t => now - t < 1000);
+            if (state.execHits.length >= EXEC_RATE_LIMIT_PER_SEC) {
+                res.writeHead(429, {
+                    ...corsHeaders(origin),
+                    'Content-Type': 'application/json',
+                    'Retry-After': '1',
+                });
+                res.end(JSON.stringify({ error: 'rate limit' }));
+                return;
+            }
+            state.execHits.push(now);
+            const body = (await readJsonBody(req));
+            if (!body.cmd || !Array.isArray(body.args)) {
+                send(res, 400, { error: 'cmd + args required' }, origin);
+                return;
+            }
+            if (!state.execAllowlist.has(body.cmd)) {
+                send(res, 403, {
+                    error: `command not allowed: ${body.cmd}. Run gsk design with --allow-build-tools to enable git/npm/python/etc.`,
+                }, origin);
+                return;
+            }
+            for (const arg of body.args) {
+                if (!_argIsSafeForCmd(body.cmd, arg)) {
+                    send(res, 400, { error: `arg rejected: ${arg.slice(0, 80)}` }, origin);
+                    return;
+                }
+            }
+            const t = Math.min(Math.max(body.timeout_sec ?? EXEC_DEFAULT_TIMEOUT_S, 1), EXEC_MAX_TIMEOUT_S);
+            const result = await runCommand(state.cwd, body.cmd, body.args, t);
+            send(res, 200, result, origin);
+            return;
+        }
+        case '/back_to_cc': {
+            const body = (await readJsonBody(req));
+            if (typeof body.prompt !== 'string' || !body.prompt.trim()) {
+                send(res, 400, { error: 'prompt required' }, origin);
+                return;
+            }
+            // The FE may send either `paths` (legacy: names only — daemon
+            // resolves) OR `files` (V2: { path, content_b64 } pre-bundled by
+            // the FE because the daemon can't reach the design project repo).
+            // V2's preferred shape is `files`; `paths` is accepted for
+            // forward-compat with daemons that bundle server-side.
+            const handoff = await writeHandoff({
+                cwd: state.cwd,
+                prompt: body.prompt,
+                files: Array.isArray(body.files) ? body.files : [],
+            });
+            // Single-shot: future requests return 410.
+            state.closed = true;
+            send(res, 200, handoff, origin);
+            // Resolve main loop so the CLI can exit — but with a small
+            // grace period so the FE has a chance to observe the 410 cascade
+            // on any in-flight follow-up calls before the server socket
+            // closes. Mirrors V3 daemon's "stay alive briefly after close"
+            // behavior so client error messages are deterministic.
+            setTimeout(() => state.finished(), 3000);
+            return;
+        }
+        case '/context': {
+            // Dead-code in Tiffany bundle but we expose it anyway so daemons
+            // that DO call it (future versions of CC, custom integrations)
+            // get a sane response. Mirrors the documented shape.
+            send(res, 200, {
+                prompt: state.prompt,
+                cwd: state.cwd,
+                ls_tree: state.lsTree,
+            }, origin);
+            return;
+        }
+        default:
+            send(res, 404, { error: 'not found' }, origin);
+    }
+}
+function runCommand(cwd, cmd, args, timeoutSec) {
+    return new Promise(resolve => {
+        const child = spawn(cmd, args, {
+            cwd,
+            // No shell — exec the binary directly. shell:true would let
+            // metacharacters through despite per-arg blocklist.
+            shell: false,
+            env: { ...process.env, PATH: process.env.PATH || '' },
+        });
+        let stdout = '';
+        let stderr = '';
+        let truncated = false;
+        let timer = setTimeout(() => {
+            child.kill('SIGKILL');
+        }, timeoutSec * 1000);
+        child.stdout.on('data', (chunk) => {
+            if (stdout.length + chunk.length > EXEC_OUTPUT_CAP) {
+                stdout += chunk.subarray(0, EXEC_OUTPUT_CAP - stdout.length).toString('utf8');
+                truncated = true;
+            }
+            else {
+                stdout += chunk.toString('utf8');
+            }
+        });
+        child.stderr.on('data', (chunk) => {
+            if (stderr.length + chunk.length > EXEC_OUTPUT_CAP) {
+                stderr += chunk.subarray(0, EXEC_OUTPUT_CAP - stderr.length).toString('utf8');
+                truncated = true;
+            }
+            else {
+                stderr += chunk.toString('utf8');
+            }
+        });
+        child.on('close', code => {
+            if (timer)
+                clearTimeout(timer);
+            timer = null;
+            resolve({
+                exit_code: code ?? -1,
+                stdout,
+                stderr,
+                truncated,
+            });
+        });
+        child.on('error', err => {
+            if (timer)
+                clearTimeout(timer);
+            timer = null;
+            resolve({
+                exit_code: -1,
+                stdout: '',
+                stderr: `spawn failed: ${err.message}`,
+                truncated: false,
+            });
+        });
+    });
+}
+async function writeHandoff(opts) {
+    // ISO 8601 → compact form: 2026-05-12T01:24:56.789Z → 20260512T012456
+    const ts = new Date()
+        .toISOString()
+        .replace(/[-:]/g, '')
+        .replace(/\..+/, '');
+    const handoffDir = path.join(opts.cwd, '.cc-bridge-out', `handoff_${ts}`);
+    await fsp.mkdir(handoffDir, { recursive: true });
+    // Gitignore the parent so the handoff dir doesn't accidentally land
+    // in a commit. Mirrors V3 daemon convention.
+    await fsp.writeFile(path.join(opts.cwd, '.cc-bridge-out', '.gitignore'), '*\n');
+    // Save the build prompt next to the artifacts.
+    await fsp.writeFile(path.join(handoffDir, '_prompt.txt'), opts.prompt, 'utf8');
+    let written = 0;
+    for (const f of opts.files) {
+        if (typeof f.path !== 'string' || !f.path)
+            continue;
+        if (typeof f.content_b64 !== 'string')
+            continue;
+        // CRITICAL: validate the FE-supplied path BEFORE joining with the
+        // handoff dir prefix. A crafted `f.path` like
+        // `../../.bashrc` survives `path.join('.cc-bridge-out',
+        // 'handoff_<ts>', '../../.bashrc')` as `.bashrc`, which IS inside
+        // cwd, so the post-join `resolveInsideCwd` would happily allow it
+        // — a write to any file in the user's cwd (Bugbot round 18
+        // Medium). Reject the raw path against the *handoff subdir* root
+        // so escape attempts are caught before normpath collapses them.
+        if (path.isAbsolute(f.path) ||
+            f.path.split(/[\\/]/).some(p => p === '..') ||
+            f.path.includes('\0')) {
+            continue;
+        }
+        const joined = path.join('.cc-bridge-out', `handoff_${ts}`, f.path);
+        const safe = resolveInsideCwd(joined, opts.cwd);
+        if (!safe.ok)
+            continue;
+        // Belt-and-braces: confirm the resolved abs path is under the
+        // handoff dir specifically, not just under cwd. The pre-check
+        // above blocks this in practice, but the assertion keeps the
+        // invariant explicit and survives future refactors.
+        const handoffPrefix = handoffDir.endsWith(path.sep)
+            ? handoffDir
+            : handoffDir + path.sep;
+        if (!safe.abs.startsWith(handoffPrefix))
+            continue;
+        await fsp.mkdir(path.dirname(safe.abs), { recursive: true });
+        await fsp.writeFile(safe.abs, Buffer.from(f.content_b64, 'base64'));
+        written++;
+    }
+    info(`✓ Wrote ${written} file(s) to ${handoffDir}`);
+    info(`✓ Build prompt:\n${opts.prompt}`);
+    return { handoff_dir: handoffDir, written_n: written };
+}
+// ---------------------------------------------------------------------------
+// Browser launch
+// ---------------------------------------------------------------------------
+function openInBrowser(url) {
+    const platform = os.platform();
+    let cmd;
+    let args;
+    if (platform === 'darwin') {
+        cmd = 'open';
+        args = [url];
+    }
+    else if (platform === 'win32') {
+        cmd = 'cmd';
+        args = ['/c', 'start', '', url];
+    }
+    else {
+        cmd = 'xdg-open';
+        args = [url];
+    }
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
+    }
+    catch (e) {
+        info(`(Could not open browser automatically: ${e.message})`);
+    }
+}
+async function runDesignCommand(pathArg, opts) {
+    const cwd = path.resolve(pathArg || process.cwd());
+    if (!fs.existsSync(cwd) || !fs.statSync(cwd).isDirectory()) {
+        logError(`Not a directory: ${cwd}`);
+        process.exit(1);
+    }
+    const state = newState({
+        cwd,
+        prompt: opts.prompt || 'Help me design a UI for this codebase.',
+        allowBuildTools: !!opts.allowBuildTools,
+    });
+    // Pre-fetch the depth-2 listing so the BE autostart hook can inline it
+    // into the synthetic first-turn message without a round-trip.
+    try {
+        const entries = await lsTree(cwd, cwd, 2);
+        state.lsTree = entries.join('\n');
+    }
+    catch (e) {
+        debug(`ls pre-fetch failed: ${e.message}`);
+        state.lsTree = '';
+    }
+    await startDataServer(state);
+    await startExchangeServer(state);
+    debug(`Started exchange on 127.0.0.1:${EXCHANGE_PORT}, data on 127.0.0.1:${state.port}`);
+    const baseLaunch = opts.launchUrl || DEFAULT_LAUNCH_URL;
+    const sep = baseLaunch.includes('#') ? '&' : '#';
+    const launchUrl = `${baseLaunch}${sep}ccbridge_nonce=${state.nonce}`;
+    info(`🔒 Bridge ready: data=127.0.0.1:${state.port} exchange=127.0.0.1:${EXCHANGE_PORT}`);
+    info(`👉 Open: ${launchUrl}`);
+    info(`   (Browser opening automatically — close the tab to exit early.)`);
+    info(`   cwd: ${cwd}`);
+    if (opts.allowBuildTools) {
+        info(`   ⚠️  --allow-build-tools enabled: git / npm / python / etc allowed`);
+    }
+    if (!opts.noOpen) {
+        openInBrowser(launchUrl);
+    }
+    // Block until /back_to_cc fires (or Ctrl-C).
+    await state.finishedPromise;
+    // Graceful shutdown.
+    state.dataServer?.close();
+    state.exchangeServer?.close();
+    output({ ok: true, handoff: 'closed' });
+}
+export function registerDesignCommand(program) {
+    program
+        .command('design')
+        .description('Open a local cc-bridge so Claude Code can hand off design work to Genspark Designer V2.')
+        .argument('[path]', 'Working directory for the design session (default: current directory)')
+        .option('--prompt <text>', 'Initial build prompt shown to the design agent in the autostart message')
+        .option('--launch-url <url>', 'Override the design page URL. Default: https://www.genspark.ai/agents?type=design')
+        .option('--allow-build-tools', 'Allow cc_exec to run git/npm/python/etc on top of the default read-only allowlist')
+        .option('--no-open', 'Print the launch URL but do not open the browser')
+        .action(async (pathArg, opts) => {
+        try {
+            await runDesignCommand(pathArg, opts);
+        }
+        catch (err) {
+            // Surface the stack on unexpected errors — bare .message loses
+            // the call site, which matters for crashes in the HTTP layer
+            // or `commit_with_retry`-style retry paths inside lsTree.
+            const e = err;
+            logError(e.stack ? e.stack : e.message);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=design.js.map