@hyperdrive.bot/fleet-server 0.3.99

package/dist/server/server/file-explorer/service.d.ts

@@ -0,0 +1,97 @@
+import type { FileHandle } from "fs/promises";
+export type ExplorerEntryKind = "file" | "directory";
+export type ExplorerFileKind = "text" | "image" | "binary";
+export type ExplorerEncoding = "utf-8" | "base64" | "none";
+export interface ListDirectoryParams {
+    root: string;
+    relativePath?: string;
+}
+export interface ReadFileParams {
+    root: string;
+    relativePath: string;
+}
+export interface FileExplorerEntry {
+    name: string;
+    path: string;
+    kind: ExplorerEntryKind;
+    size: number;
+    modifiedAt: string;
+}
+export interface FileExplorerDirectory {
+    path: string;
+    entries: FileExplorerEntry[];
+}
+export interface FileExplorerFile {
+    path: string;
+    kind: ExplorerFileKind;
+    encoding: ExplorerEncoding;
+    content?: string;
+    mimeType?: string;
+    size: number;
+    modifiedAt: string;
+}
+export interface FileExplorerFileBytes {
+    path: string;
+    kind: ExplorerFileKind;
+    encoding: "utf-8" | "binary";
+    bytes: Uint8Array;
+    mimeType: string;
+    size: number;
+    modifiedAt: string;
+}
+export declare function listDirectoryEntries({ root, relativePath, }: ListDirectoryParams): Promise<FileExplorerDirectory>;
+export declare function readExplorerFile({ root, relativePath, }: ReadFileParams): Promise<FileExplorerFile>;
+export interface ExplorerFileClassification {
+    kind: ExplorerFileKind;
+    mimeType: string;
+    encoding: "utf-8" | "binary";
+}
+/**
+ * Largest binary we will stream to a client for an inline preview.
+ *
+ * Preview is a "look at it now" affordance, not a transfer. Beyond this the client shows
+ * file metadata plus a download action instead, which keeps a 2 GB archive from being
+ * chunked across the relay into a phone's memory just because someone tapped it.
+ * Explicit downloads are unaffected - they go through the HTTP token route.
+ */
+export declare const MAX_INLINE_PREVIEW_BYTES: number;
+/**
+ * Classify a file and return its metadata WITHOUT reading its contents.
+ *
+ * Used when a file is too large to preview inline: the client still needs an honest mime
+ * type and size to render "PDF document, 1.4 GB" with a download button, and reading the
+ * bytes to produce that would be the exact thing we are trying to avoid.
+ */
+export declare function readExplorerFileMetadata({ root, relativePath, }: ReadFileParams): Promise<FileExplorerFile>;
+export declare function readExplorerFileBytes({ root, relativePath, }: ReadFileParams): Promise<FileExplorerFileBytes>;
+export interface OpenExplorerFileForDownload {
+    handle: FileHandle;
+    metadata: {
+        mime: string;
+        size: number;
+        encoding: "utf-8" | "binary";
+        modifiedAt: string;
+    };
+    path: string;
+}
+/**
+ * Open a file for a streaming binary download. Mirrors `readExplorerFileBytes`'s
+ * mime/kind/encoding detection but NEVER loads the whole file: it classifies the
+ * file from a bounded detection prefix and returns the still-open handle so the
+ * caller can stream chunk-sized positioned reads (see `encodeFileDownloadFrames`).
+ *
+ * The returned handle is the caller's to close — the success path transfers
+ * ownership; only the error path closes it here to avoid leaking a descriptor.
+ *
+ * @returns the open file handle, FileBegin metadata, and the workspace-relative path.
+ * @throws if the path resolves outside the workspace or is not a regular file.
+ */
+export declare function openExplorerFileForDownload({ root, relativePath, }: ReadFileParams): Promise<OpenExplorerFileForDownload>;
+export declare function getDownloadableFileInfo({ root, relativePath }: ReadFileParams): Promise<{
+    path: string;
+    absolutePath: string;
+    fileName: string;
+    mimeType: string;
+    size: number;
+}>;
+//# sourceMappingURL=service.d.ts.map

package/dist/server/server/file-explorer/service.js

@@ -0,0 +1,362 @@
+import { constants, promises as fs } from "fs";
+import path from "path";
+import { UPLOAD_CHUNK_SIZE_BYTES } from "@hyperdrive.bot/fleet-protocol/binary-frames/chunk-size";
+import { expandUserPath, resolvePathFromBase } from "../path-utils.js";
+import { BINARY_MIME_TYPES, IMAGE_MIME_TYPES, isImageMimeType, resolveBinaryMimeType, } from "./mime-types.js";
+const TEXT_MIME_TYPES = {
+    ".json": "application/json",
+    // HTML is textual, so it classifies as `kind: "text"` and its bytes arrive as UTF-8.
+    // Naming the mime honestly is what lets the client render it instead of showing source.
+    ".html": "text/html",
+    ".htm": "text/html",
+    ".xhtml": "application/xhtml+xml",
+    ".css": "text/css",
+    ".csv": "text/csv",
+    ".xml": "application/xml",
+    ".md": "text/markdown",
+};
+const DEFAULT_TEXT_MIME_TYPE = "text/plain";
+const FILE_TYPE_SAMPLE_BYTES = 8192;
+const READ_FILE_OPEN_FLAGS = process.platform === "win32" ? constants.O_RDONLY : constants.O_RDONLY | constants.O_NOFOLLOW;
+const ACCESS_OUTSIDE_WORKSPACE_MESSAGE = "Access outside of workspace is not allowed";
+export async function listDirectoryEntries({ root, relativePath = ".", }) {
+    const directoryPath = await resolveScopedPath({ root, relativePath });
+    const stats = await fs.stat(directoryPath.resolvedPath);
+    if (!stats.isDirectory()) {
+        throw new Error("Requested path is not a directory");
+    }
+    const dirents = await fs.readdir(directoryPath.resolvedPath, { withFileTypes: true });
+    const entriesWithNulls = await Promise.all(dirents.map(async (dirent) => {
+        const targetPath = path.join(directoryPath.requestedPath, dirent.name);
+        const kind = dirent.isDirectory() ? "directory" : "file";
+        try {
+            return await buildEntryPayload({
+                root,
+                targetPath,
+                name: dirent.name,
+                kind,
+            });
+        }
+        catch (error) {
+            // Directories can contain dangling links (e.g. AGENTS.md -> CLAUDE.md).
+            // Skip entries whose targets disappeared instead of failing the whole listing.
+            if (isMissingEntryError(error) || isOutsideWorkspaceError(error)) {
+                return null;
+            }
+            throw error;
+        }
+    }));
+    const entries = entriesWithNulls.filter((entry) => entry !== null);
+    entries.sort((a, b) => {
+        const modifiedComparison = new Date(b.modifiedAt).getTime() - new Date(a.modifiedAt).getTime();
+        if (modifiedComparison !== 0) {
+            return modifiedComparison;
+        }
+        return a.name.localeCompare(b.name);
+    });
+    return {
+        path: normalizeRelativePath({ root, targetPath: directoryPath.requestedPath }),
+        entries,
+    };
+}
+export async function readExplorerFile({ root, relativePath, }) {
+    const file = await readExplorerFileBytes({ root, relativePath });
+    if (file.kind === "image") {
+        return {
+            path: file.path,
+            kind: file.kind,
+            encoding: "base64",
+            content: Buffer.from(file.bytes).toString("base64"),
+            mimeType: file.mimeType,
+            size: file.size,
+            modifiedAt: file.modifiedAt,
+        };
+    }
+    if (file.kind === "binary") {
+        return {
+            path: file.path,
+            kind: file.kind,
+            encoding: "none",
+            mimeType: file.mimeType,
+            size: file.size,
+            modifiedAt: file.modifiedAt,
+        };
+    }
+    return {
+        path: file.path,
+        kind: file.kind,
+        encoding: "utf-8",
+        content: Buffer.from(file.bytes).toString("utf-8"),
+        mimeType: file.mimeType,
+        size: file.size,
+        modifiedAt: file.modifiedAt,
+    };
+}
+/**
+ * Decide kind/mime/encoding for a file from its extension and a prefix of its bytes.
+ *
+ * Single source of truth for all three read paths (whole-file read, streaming download,
+ * download-token metadata) so they can never disagree about what a file is - a client
+ * that previews a PDF inline and then downloads it must see the same mime both times.
+ *
+ * @param detectionBytes - a prefix is sufficient; only the leading bytes are inspected
+ *   for magic numbers, and `isLikelyBinary` is a heuristic over whatever it is given.
+ */
+function classifyExplorerFile({ extension, detectionBytes, }) {
+    // Extension wins for images: an .svg is textual and would otherwise classify as text,
+    // and a .docx would otherwise be indistinguishable from a plain .zip.
+    if (extension in IMAGE_MIME_TYPES) {
+        return { kind: "image", mimeType: IMAGE_MIME_TYPES[extension], encoding: "binary" };
+    }
+    // Extension wins for known binary formats too, and for the same reason it wins for
+    // images: `isLikelyBinary` is a heuristic over bytes, and several of these formats are
+    // legitimately ASCII in their first 8 KiB. An uncompressed PDF can contain no NUL and
+    // no control bytes at all, and RTF is a plain-text format by construction, so gating
+    // the mime lookup behind the heuristic made `application/pdf` file-dependent and
+    // `application/rtf` unreachable. A file that reaches a client as `kind: "text"` is
+    // rendered as source, which is how a PDF ended up displayed as its own markup.
+    //
+    // The heuristic still runs below, where it does the job it is actually good at:
+    // identifying binaries whose extension is missing, wrong, or unknown to us.
+    if (extension in BINARY_MIME_TYPES) {
+        return { kind: "binary", mimeType: BINARY_MIME_TYPES[extension], encoding: "binary" };
+    }
+    if (isLikelyBinary(detectionBytes)) {
+        const mimeType = resolveBinaryMimeType({ extension, detectionBytes });
+        // A PNG saved as `.bin` still renders: magic bytes promote it back to an image.
+        return {
+            kind: isImageMimeType(mimeType) ? "image" : "binary",
+            mimeType,
+            encoding: "binary",
+        };
+    }
+    return { kind: "text", mimeType: textMimeTypeForExtension(extension), encoding: "utf-8" };
+}
+/**
+ * Read a bounded prefix for type detection without consuming the whole file.
+ *
+ * @returns at most `FILE_TYPE_SAMPLE_BYTES`, or fewer for a shorter file.
+ */
+async function readDetectionPrefix(handle, size) {
+    const length = Math.min(size, FILE_TYPE_SAMPLE_BYTES);
+    if (length <= 0) {
+        return Buffer.alloc(0);
+    }
+    const prefix = Buffer.allocUnsafe(length);
+    const { bytesRead } = await handle.read(prefix, 0, length, 0);
+    return bytesRead < prefix.length ? prefix.subarray(0, bytesRead) : prefix;
+}
+/**
+ * Largest binary we will stream to a client for an inline preview.
+ *
+ * Preview is a "look at it now" affordance, not a transfer. Beyond this the client shows
+ * file metadata plus a download action instead, which keeps a 2 GB archive from being
+ * chunked across the relay into a phone's memory just because someone tapped it.
+ * Explicit downloads are unaffected - they go through the HTTP token route.
+ */
+export const MAX_INLINE_PREVIEW_BYTES = 25 * 1024 * 1024;
+/**
+ * Classify a file and return its metadata WITHOUT reading its contents.
+ *
+ * Used when a file is too large to preview inline: the client still needs an honest mime
+ * type and size to render "PDF document, 1.4 GB" with a download button, and reading the
+ * bytes to produce that would be the exact thing we are trying to avoid.
+ */
+export async function readExplorerFileMetadata({ root, relativePath, }) {
+    const filePath = await resolveScopedPath({ root, relativePath });
+    const handle = await openFileForRead(filePath.resolvedPath);
+    try {
+        const stats = await handle.stat();
+        if (!stats.isFile()) {
+            throw new Error("Requested path is not a file");
+        }
+        const ext = path.extname(filePath.resolvedPath).toLowerCase();
+        const detectionBytes = await readDetectionPrefix(handle, stats.size);
+        const classification = classifyExplorerFile({ extension: ext, detectionBytes });
+        return {
+            path: normalizeRelativePath({ root, targetPath: filePath.requestedPath }),
+            kind: classification.kind,
+            encoding: "none",
+            mimeType: classification.mimeType,
+            size: stats.size,
+            modifiedAt: stats.mtime.toISOString(),
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readExplorerFileBytes({ root, relativePath, }) {
+    const filePath = await resolveScopedPath({ root, relativePath });
+    const handle = await openFileForRead(filePath.resolvedPath);
+    try {
+        const stats = await handle.stat();
+        if (!stats.isFile()) {
+            throw new Error("Requested path is not a file");
+        }
+        const ext = path.extname(filePath.resolvedPath).toLowerCase();
+        const basePayload = {
+            path: normalizeRelativePath({ root, targetPath: filePath.requestedPath }),
+            size: stats.size,
+            modifiedAt: stats.mtime.toISOString(),
+        };
+        const buffer = await handle.readFile();
+        const classification = classifyExplorerFile({ extension: ext, detectionBytes: buffer });
+        return {
+            ...basePayload,
+            kind: classification.kind,
+            encoding: classification.encoding,
+            bytes: buffer,
+            mimeType: classification.mimeType,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Open a file for a streaming binary download. Mirrors `readExplorerFileBytes`'s
+ * mime/kind/encoding detection but NEVER loads the whole file: it classifies the
+ * file from a bounded detection prefix and returns the still-open handle so the
+ * caller can stream chunk-sized positioned reads (see `encodeFileDownloadFrames`).
+ *
+ * The returned handle is the caller's to close — the success path transfers
+ * ownership; only the error path closes it here to avoid leaking a descriptor.
+ *
+ * @returns the open file handle, FileBegin metadata, and the workspace-relative path.
+ * @throws if the path resolves outside the workspace or is not a regular file.
+ */
+export async function openExplorerFileForDownload({ root, relativePath, }) {
+    const filePath = await resolveScopedPath({ root, relativePath });
+    const handle = await openFileForRead(filePath.resolvedPath);
+    try {
+        const stats = await handle.stat();
+        if (!stats.isFile()) {
+            throw new Error("Requested path is not a file");
+        }
+        const ext = path.extname(filePath.resolvedPath).toLowerCase();
+        const normalizedPath = normalizeRelativePath({ root, targetPath: filePath.requestedPath });
+        const baseMetadata = {
+            size: stats.size,
+            modifiedAt: stats.mtime.toISOString(),
+        };
+        // Detection-only read: classify the file from a bounded prefix instead of
+        // `handle.readFile()`-ing the whole file, which would defeat the streaming
+        // download path. Capped by the chunk size so detection never outgrows a frame.
+        const detectionBytes = await readDetectionPrefix(handle, Math.min(stats.size, UPLOAD_CHUNK_SIZE_BYTES));
+        const classification = classifyExplorerFile({ extension: ext, detectionBytes });
+        return {
+            handle,
+            path: normalizedPath,
+            metadata: {
+                ...baseMetadata,
+                mime: classification.mimeType,
+                encoding: classification.encoding,
+            },
+        };
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+export async function getDownloadableFileInfo({ root, relativePath }) {
+    const filePath = await resolveScopedPath({ root, relativePath });
+    const handle = await openFileForRead(filePath.resolvedPath);
+    try {
+        const stats = await handle.stat();
+        if (!stats.isFile()) {
+            throw new Error("Requested path is not a file");
+        }
+        const ext = path.extname(filePath.resolvedPath).toLowerCase();
+        const detectionBytes = await readDetectionPrefix(handle, stats.size);
+        const { mimeType } = classifyExplorerFile({ extension: ext, detectionBytes });
+        return {
+            path: normalizeRelativePath({ root, targetPath: filePath.requestedPath }),
+            absolutePath: filePath.resolvedPath,
+            fileName: path.basename(filePath.requestedPath),
+            mimeType,
+            size: stats.size,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function resolveScopedPath({ root, relativePath = ".", }) {
+    const normalizedRoot = expandUserPath(root);
+    const requestedPath = resolvePathFromBase(normalizedRoot, relativePath);
+    const relative = path.relative(normalizedRoot, requestedPath);
+    if (relative !== "" && (relative.startsWith("..") || path.isAbsolute(relative))) {
+        throw new Error(ACCESS_OUTSIDE_WORKSPACE_MESSAGE);
+    }
+    const realRoot = await fs.realpath(normalizedRoot);
+    try {
+        const realPath = await fs.realpath(requestedPath);
+        const realRelative = path.relative(realRoot, realPath);
+        if (realRelative !== "" && (realRelative.startsWith("..") || path.isAbsolute(realRelative))) {
+            throw new Error(ACCESS_OUTSIDE_WORKSPACE_MESSAGE);
+        }
+        return { requestedPath, resolvedPath: realPath };
+    }
+    catch (error) {
+        if (isMissingEntryError(error)) {
+            return { requestedPath, resolvedPath: requestedPath };
+        }
+        throw error;
+    }
+}
+async function openFileForRead(filePath) {
+    return fs.open(filePath, READ_FILE_OPEN_FLAGS);
+}
+async function buildEntryPayload({ root, targetPath, name, kind, }) {
+    const entryPath = await resolveScopedPath({
+        root,
+        relativePath: normalizeRelativePath({ root, targetPath }),
+    });
+    const stats = await fs.stat(entryPath.resolvedPath);
+    return {
+        name,
+        path: normalizeRelativePath({ root, targetPath }),
+        kind,
+        size: stats.size,
+        modifiedAt: stats.mtime.toISOString(),
+    };
+}
+function isMissingEntryError(error) {
+    const code = error?.code;
+    return code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP";
+}
+function isOutsideWorkspaceError(error) {
+    return error instanceof Error && error.message === ACCESS_OUTSIDE_WORKSPACE_MESSAGE;
+}
+function normalizeRelativePath({ root, targetPath }) {
+    const normalizedRoot = expandUserPath(root);
+    const normalizedTarget = expandUserPath(targetPath);
+    const relative = path.relative(normalizedRoot, normalizedTarget);
+    return relative === "" ? "." : relative.split(path.sep).join("/");
+}
+function textMimeTypeForExtension(ext) {
+    return TEXT_MIME_TYPES[ext] ?? DEFAULT_TEXT_MIME_TYPE;
+}
+function isLikelyBinary(buffer) {
+    if (buffer.length === 0) {
+        return false;
+    }
+    let suspicious = 0;
+    for (let idx = 0; idx < buffer.length; idx += 1) {
+        const byte = buffer[idx];
+        if (byte === 0) {
+            return true;
+        }
+        const isControl = byte < 32 &&
+            byte !== 9 && // tab
+            byte !== 10 && // newline
+            byte !== 13; // carriage return
+        if (isControl || byte === 127) {
+            suspicious += 1;
+        }
+    }
+    return suspicious / buffer.length > 0.3;
+}
+//# sourceMappingURL=service.js.map

package/dist/server/server/file-upload/index.d.ts

@@ -0,0 +1,27 @@
+import { type FileTransferFrame } from "@hyperdrive.bot/fleet-protocol/binary-frames/index";
+import type { FileUploadRequest, FileUploadResponse } from "../messages.js";
+interface FileUploadStoreOptions {
+    paseoHome: string;
+    staleUploadTimeoutMs?: number;
+}
+export declare class FileUploadStore {
+    private static readonly defaultStaleUploadTimeoutMs;
+    private readonly paseoHome;
+    private readonly staleUploadTimeoutMs;
+    private readonly pending;
+    constructor(options: FileUploadStoreOptions);
+    beginUpload(request: FileUploadRequest): void;
+    receiveFrame(frame: FileTransferFrame): Promise<FileUploadResponse | null>;
+    private applyFrame;
+    private startWriting;
+    private writeChunk;
+    private completeUpload;
+    private createStaleUploadTimeout;
+    private refreshStaleUploadTimeout;
+    private expireStaleUpload;
+    private clearPendingUpload;
+    private removeFailedUpload;
+    private removeUploadDirectory;
+}
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/server/server/file-upload/index.js

@@ -0,0 +1,158 @@
+import { appendFile, mkdir, rm, writeFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { FileTransferOpcode, } from "@hyperdrive.bot/fleet-protocol/binary-frames/index";
+import { getErrorMessage } from "@hyperdrive.bot/fleet-protocol/error-utils";
+export class FileUploadStore {
+    constructor(options) {
+        this.pending = new Map();
+        this.paseoHome = options.paseoHome;
+        this.staleUploadTimeoutMs =
+            options.staleUploadTimeoutMs ?? FileUploadStore.defaultStaleUploadTimeoutMs;
+    }
+    beginUpload(request) {
+        const existingUpload = this.pending.get(request.requestId);
+        if (existingUpload) {
+            this.clearPendingUpload(existingUpload);
+            void existingUpload.queue.then(() => this.removeUploadDirectory(existingUpload));
+        }
+        const fileName = sanitizeFileName(request.fileName);
+        const attempt = existingUpload ? existingUpload.attempt + 1 : 1;
+        const id = buildUploadId(request.requestId, attempt);
+        const uploadDir = join(this.paseoHome, "uploads", id);
+        const upload = {
+            requestId: request.requestId,
+            id,
+            attempt,
+            fileName,
+            mimeType: request.mimeType,
+            size: request.size,
+            path: join(uploadDir, fileName),
+            receivedBytes: 0,
+            started: false,
+            staleTimeout: this.createStaleUploadTimeout(request.requestId),
+            queue: Promise.resolve(),
+        };
+        this.pending.set(request.requestId, upload);
+    }
+    async receiveFrame(frame) {
+        const upload = this.pending.get(frame.requestId);
+        if (!upload) {
+            return null;
+        }
+        this.refreshStaleUploadTimeout(upload);
+        const operation = upload.queue.then(() => this.applyFrame(upload, frame));
+        upload.queue = operation.then(() => undefined, () => undefined);
+        return operation;
+    }
+    async applyFrame(upload, frame) {
+        if (this.pending.get(upload.requestId) !== upload) {
+            return null;
+        }
+        try {
+            if (frame.opcode === FileTransferOpcode.FileBegin) {
+                await this.startWriting(upload);
+                return null;
+            }
+            if (frame.opcode === FileTransferOpcode.FileChunk) {
+                await this.writeChunk(upload, frame.payload);
+                return null;
+            }
+            return await this.completeUpload(upload);
+        }
+        catch (error) {
+            await this.removeFailedUpload(upload);
+            return buildUploadResponse(upload, getErrorMessage(error));
+        }
+    }
+    async startWriting(upload) {
+        await mkdir(join(this.paseoHome, "uploads", upload.id), { recursive: true });
+        await writeFile(upload.path, new Uint8Array());
+        upload.started = true;
+    }
+    async writeChunk(upload, bytes) {
+        if (!upload.started) {
+            throw new Error("Upload chunks arrived before file begin.");
+        }
+        const nextReceivedBytes = upload.receivedBytes + bytes.byteLength;
+        if (nextReceivedBytes > upload.size) {
+            throw new Error(`Upload exceeded declared size: expected ${upload.size}, received ${nextReceivedBytes}.`);
+        }
+        await appendFile(upload.path, bytes);
+        upload.receivedBytes += bytes.byteLength;
+    }
+    async completeUpload(upload) {
+        this.clearPendingUpload(upload);
+        if (upload.receivedBytes !== upload.size) {
+            await this.removeUploadDirectory(upload);
+            return buildUploadResponse(upload, `Upload size mismatch: expected ${upload.size}, received ${upload.receivedBytes}.`);
+        }
+        return buildUploadResponse(upload, null);
+    }
+    createStaleUploadTimeout(requestId) {
+        const timeout = setTimeout(() => {
+            this.expireStaleUpload(requestId);
+        }, this.staleUploadTimeoutMs);
+        timeout.unref?.();
+        return timeout;
+    }
+    refreshStaleUploadTimeout(upload) {
+        clearTimeout(upload.staleTimeout);
+        upload.staleTimeout = this.createStaleUploadTimeout(upload.requestId);
+    }
+    expireStaleUpload(requestId) {
+        const upload = this.pending.get(requestId);
+        if (!upload) {
+            return;
+        }
+        this.clearPendingUpload(upload);
+        const cleanup = upload.queue.then(() => this.removeUploadDirectory(upload), () => this.removeUploadDirectory(upload));
+        upload.queue = cleanup.then(() => undefined, () => undefined);
+    }
+    clearPendingUpload(upload) {
+        clearTimeout(upload.staleTimeout);
+        if (this.pending.get(upload.requestId) === upload) {
+            this.pending.delete(upload.requestId);
+        }
+    }
+    async removeFailedUpload(upload) {
+        this.clearPendingUpload(upload);
+        await this.removeUploadDirectory(upload);
+    }
+    async removeUploadDirectory(upload) {
+        await rm(join(this.paseoHome, "uploads", upload.id), { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+FileUploadStore.defaultStaleUploadTimeoutMs = 10 * 60 * 1000;
+function buildUploadResponse(upload, error) {
+    return {
+        type: "file.upload.response",
+        payload: {
+            requestId: upload.requestId,
+            file: error
+                ? null
+                : {
+                    type: "uploaded_file",
+                    id: upload.id,
+                    fileName: upload.fileName,
+                    mimeType: upload.mimeType,
+                    size: upload.size,
+                    path: upload.path,
+                },
+            error,
+        },
+    };
+}
+function sanitizeUploadId(value) {
+    return value.replace(/[^a-zA-Z0-9._-]/g, "_") || "file";
+}
+function buildUploadId(requestId, attempt) {
+    const baseId = `upload_${sanitizeUploadId(requestId)}`;
+    return attempt === 1 ? baseId : `${baseId}_${attempt}`;
+}
+function sanitizeFileName(value) {
+    const name = basename(value)
+        .replace(/[^a-zA-Z0-9._ -]/g, "_")
+        .trim();
+    return name.length > 0 && name !== "." && name !== ".." ? name : "upload";
+}
+//# sourceMappingURL=index.js.map

package/dist/server/server/fleet/decision-service.d.ts

@@ -0,0 +1,47 @@
+import { type CreateLoopDecisionInput, type LoopDecision, type LoopDecisionResolver } from "@hyperdrive.bot/fleet-protocol/fleet/decisions";
+/**
+ * Store + lifecycle for loop decisions.
+ *
+ * File-backed under `<paseoHome>/fleet/decisions/<id>.json`, matching how the rest of
+ * the daemon persists (plain JSON, atomic rename, no migrations).
+ *
+ * The service owns exactly one piece of behaviour beyond CRUD: expiry. A decision that
+ * can time out MUST resolve when it does, and that resolution is recorded with
+ * `resolvedBy: { kind: "expiry" }` so a timed-out decision is never mistaken for one a
+ * human answered. Silence becomes a fact with an author.
+ */
+export interface DecisionServiceOptions {
+    paseoHome: string;
+    now?: () => Date;
+}
+export declare class LoopDecisionService {
+    private readonly dir;
+    private readonly now;
+    constructor(options: DecisionServiceOptions);
+    private pathFor;
+    private writeAtomic;
+    create(input: CreateLoopDecisionInput): LoopDecision;
+    private readAll;
+    /**
+     * The inbox. Expiry is applied on read so a decision cannot appear pending after its
+     * clock ran out just because no tick happened to fire.
+     */
+    list(options?: {
+        loopName?: string;
+        includeResolved?: boolean;
+    }): LoopDecision[];
+    get(id: string): LoopDecision | null;
+    /** Resolve a decision. Idempotent: an already-resolved decision is returned as-is. */
+    resolve(id: string, optionId: string, by: LoopDecisionResolver): LoopDecision;
+    /**
+     * Resolve every pending decision whose clock has run out, applying its `onExpiry`.
+     * Attributed to `expiry`, never left looking like a human answered.
+     */
+    applyExpiries(): LoopDecision[];
+    /**
+     * Count of decisions a person still has to answer, per loop. Drives the "needs you"
+     * badge on the Loops index.
+     */
+    pendingCountByLoop(): Record<string, number>;
+}
+//# sourceMappingURL=decision-service.d.ts.map