@jlongo78/agent-spaces 0.9.6 → 0.9.8

package/.next/standalone/src/app/api/files/route.ts

@@ -1,187 +1,187 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { getAuthUser, withUser } from '@/lib/auth';
-import fs from 'fs';
-import path from 'path';
-
-export const dynamic = 'force-dynamic';
-
-const IMAGE_EXTS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.ico', '.bmp', '.webp', '.svg']);
-
-const BINARY_EXTS = new Set([
-  '.woff', '.woff2', '.ttf', '.eot', '.otf',
-  '.zip', '.gz', '.tar', '.rar', '.7z',
-  '.exe', '.dll', '.so', '.dylib', '.node',
-  '.mp3', '.mp4', '.wav', '.avi', '.mov',
-  '.db', '.sqlite', '.sqlite3',
-]);
-
-const IGNORE = new Set(['node_modules', '.git', '.next', '__pycache__', '.turbo', 'dist', '.cache']);
-
-const MIME: Record<string, string> = {
-  '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
-  '.gif': 'image/gif', '.ico': 'image/x-icon', '.bmp': 'image/bmp',
-  '.webp': 'image/webp', '.svg': 'image/svg+xml',
-  '.pdf': 'application/pdf',
-};
-
-// Max text file size for JSON response (5MB)
-const MAX_TEXT_SIZE = 5 * 1024 * 1024;
-// Max image size for base64 response (20MB)
-const MAX_IMAGE_SIZE = 20 * 1024 * 1024;
-
-export async function GET(request: NextRequest) {
-  const user = getAuthUser(request);
-  return withUser(user, async () => {
-    const dir = request.nextUrl.searchParams.get('path');
-    const file = request.nextUrl.searchParams.get('file');
-    const raw = request.nextUrl.searchParams.get('raw');
-    const limit = parseInt(request.nextUrl.searchParams.get('limit') || '2000', 10);
-
-    // Serve raw file (for images in <img> tags)
-    if (raw) {
-      try {
-        const resolved = path.resolve(raw);
-        const ext = path.extname(resolved).toLowerCase();
-        const stat = fs.statSync(resolved);
-        const mime = MIME[ext] || 'application/octet-stream';
-        const data = fs.readFileSync(resolved);
-        return new NextResponse(data, {
-          headers: {
-            'Content-Type': mime,
-            'Content-Length': String(stat.size),
-            'Cache-Control': 'private, max-age=60',
-          },
-        });
-      } catch {
-        return new NextResponse('Not found', { status: 404 });
-      }
-    }
-
-    // Read file contents
-    if (file) {
-      try {
-        const resolved = path.resolve(file);
-        const stat = fs.statSync(resolved);
-        const ext = path.extname(resolved).toLowerCase();
-
-        // Images — return metadata with base64 data URL for small ones, raw URL for large
-        if (IMAGE_EXTS.has(ext)) {
-          if (stat.size > MAX_IMAGE_SIZE) {
-            return NextResponse.json({ image: true, tooLarge: true, ext, size: stat.size, name: path.basename(resolved) });
-          }
-          return NextResponse.json({
-            name: path.basename(resolved),
-            path: resolved,
-            image: true,
-            ext,
-            size: stat.size,
-            // Client will use the raw endpoint to load the image
-            rawUrl: `/api/files?raw=${encodeURIComponent(resolved)}`,
-          });
-        }
-
-        // PDF
-        if (ext === '.pdf') {
-          return NextResponse.json({
-            name: path.basename(resolved),
-            path: resolved,
-            pdf: true,
-            ext,
-            size: stat.size,
-            rawUrl: `/api/files?raw=${encodeURIComponent(resolved)}`,
-          });
-        }
-
-        // Binary files we can't display
-        if (BINARY_EXTS.has(ext)) {
-          return NextResponse.json({ binary: true, ext, size: stat.size, name: path.basename(resolved) });
-        }
-
-        // Text files
-        if (stat.size > MAX_TEXT_SIZE) {
-          return NextResponse.json({ error: 'File too large', size: stat.size, name: path.basename(resolved) });
-        }
-
-        const content = fs.readFileSync(resolved, 'utf-8');
-        const lines = content.split('\n');
-        return NextResponse.json({
-          name: path.basename(resolved),
-          path: resolved,
-          content: lines.length > limit ? lines.slice(0, limit).join('\n') : content,
-          lines: lines.length,
-          truncated: lines.length > limit,
-          size: stat.size,
-          ext,
-        });
-      } catch {
-        return NextResponse.json({ error: 'Cannot read file' }, { status: 404 });
-      }
-    }
-
-    // List directory
-    if (!dir) {
-      return NextResponse.json({ error: 'path parameter required' }, { status: 400 });
-    }
-
-    try {
-      const resolved = path.resolve(dir);
-      const entries = fs.readdirSync(resolved, { withFileTypes: true });
-
-      const items = entries
-        .filter(e => !IGNORE.has(e.name) && !e.name.startsWith('.'))
-        .map(e => ({
-          name: e.name,
-          path: path.join(resolved, e.name),
-          isDir: e.isDirectory(),
-          ext: e.isDirectory() ? null : path.extname(e.name).toLowerCase(),
-        }))
-        .sort((a, b) => {
-          if (a.isDir !== b.isDir) return a.isDir ? -1 : 1;
-          return a.name.localeCompare(b.name);
-        });
-
-      return NextResponse.json({
-        current: resolved,
-        parent: path.dirname(resolved),
-        items,
-      });
-    } catch {
-      return NextResponse.json({ error: 'Cannot read directory' }, { status: 404 });
-    }
-  });
-}
-
-export async function POST(request: NextRequest) {
-  const user = getAuthUser(request);
-  return withUser(user, async () => {
-    try {
-      const formData = await request.formData();
-      const dir = formData.get('dir') as string;
-      if (!dir) return NextResponse.json({ error: 'dir required' }, { status: 400 });
-
-      const resolved = path.resolve(dir);
-      if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {
-        return NextResponse.json({ error: 'Directory not found' }, { status: 404 });
-      }
-
-      const files = formData.getAll('files') as File[];
-      if (files.length === 0) return NextResponse.json({ error: 'No files provided' }, { status: 400 });
-
-      const saved: string[] = [];
-      for (const file of files) {
-        // Sanitize filename — strip path separators to prevent traversal
-        const safeName = file.name.replace(/[/\\]/g, '_');
-        if (!safeName || safeName === '.' || safeName === '..') continue;
-
-        const destPath = path.join(resolved, safeName);
-        const buffer = Buffer.from(await file.arrayBuffer());
-        fs.writeFileSync(destPath, buffer);
-        saved.push(safeName);
-      }
-
-      return NextResponse.json({ uploaded: saved.length, files: saved });
-    } catch (err) {
-      return NextResponse.json({ error: 'Upload failed' }, { status: 500 });
-    }
-  });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { getAuthUser, withUser } from '@/lib/auth';
+import fs from 'fs';
+import path from 'path';
+
+export const dynamic = 'force-dynamic';
+
+const IMAGE_EXTS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.ico', '.bmp', '.webp', '.svg']);
+
+const BINARY_EXTS = new Set([
+  '.woff', '.woff2', '.ttf', '.eot', '.otf',
+  '.zip', '.gz', '.tar', '.rar', '.7z',
+  '.exe', '.dll', '.so', '.dylib', '.node',
+  '.mp3', '.mp4', '.wav', '.avi', '.mov',
+  '.db', '.sqlite', '.sqlite3',
+]);
+
+const IGNORE = new Set(['node_modules', '.git', '.next', '__pycache__', '.turbo', 'dist', '.cache']);
+
+const MIME: Record<string, string> = {
+  '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif', '.ico': 'image/x-icon', '.bmp': 'image/bmp',
+  '.webp': 'image/webp', '.svg': 'image/svg+xml',
+  '.pdf': 'application/pdf',
+};
+
+// Max text file size for JSON response (5MB)
+const MAX_TEXT_SIZE = 5 * 1024 * 1024;
+// Max image size for base64 response (20MB)
+const MAX_IMAGE_SIZE = 20 * 1024 * 1024;
+
+export async function GET(request: NextRequest) {
+  const user = getAuthUser(request);
+  return withUser(user, async () => {
+    const dir = request.nextUrl.searchParams.get('path');
+    const file = request.nextUrl.searchParams.get('file');
+    const raw = request.nextUrl.searchParams.get('raw');
+    const limit = parseInt(request.nextUrl.searchParams.get('limit') || '2000', 10);
+
+    // Serve raw file (for images in <img> tags)
+    if (raw) {
+      try {
+        const resolved = path.resolve(raw);
+        const ext = path.extname(resolved).toLowerCase();
+        const stat = fs.statSync(resolved);
+        const mime = MIME[ext] || 'application/octet-stream';
+        const data = fs.readFileSync(resolved);
+        return new NextResponse(data, {
+          headers: {
+            'Content-Type': mime,
+            'Content-Length': String(stat.size),
+            'Cache-Control': 'private, max-age=60',
+          },
+        });
+      } catch {
+        return new NextResponse('Not found', { status: 404 });
+      }
+    }
+
+    // Read file contents
+    if (file) {
+      try {
+        const resolved = path.resolve(file);
+        const stat = fs.statSync(resolved);
+        const ext = path.extname(resolved).toLowerCase();
+
+        // Images — return metadata with base64 data URL for small ones, raw URL for large
+        if (IMAGE_EXTS.has(ext)) {
+          if (stat.size > MAX_IMAGE_SIZE) {
+            return NextResponse.json({ image: true, tooLarge: true, ext, size: stat.size, name: path.basename(resolved) });
+          }
+          return NextResponse.json({
+            name: path.basename(resolved),
+            path: resolved,
+            image: true,
+            ext,
+            size: stat.size,
+            // Client will use the raw endpoint to load the image
+            rawUrl: `/api/files?raw=${encodeURIComponent(resolved)}`,
+          });
+        }
+
+        // PDF
+        if (ext === '.pdf') {
+          return NextResponse.json({
+            name: path.basename(resolved),
+            path: resolved,
+            pdf: true,
+            ext,
+            size: stat.size,
+            rawUrl: `/api/files?raw=${encodeURIComponent(resolved)}`,
+          });
+        }
+
+        // Binary files we can't display
+        if (BINARY_EXTS.has(ext)) {
+          return NextResponse.json({ binary: true, ext, size: stat.size, name: path.basename(resolved) });
+        }
+
+        // Text files
+        if (stat.size > MAX_TEXT_SIZE) {
+          return NextResponse.json({ error: 'File too large', size: stat.size, name: path.basename(resolved) });
+        }
+
+        const content = fs.readFileSync(resolved, 'utf-8');
+        const lines = content.split('\n');
+        return NextResponse.json({
+          name: path.basename(resolved),
+          path: resolved,
+          content: lines.length > limit ? lines.slice(0, limit).join('\n') : content,
+          lines: lines.length,
+          truncated: lines.length > limit,
+          size: stat.size,
+          ext,
+        });
+      } catch {
+        return NextResponse.json({ error: 'Cannot read file' }, { status: 404 });
+      }
+    }
+
+    // List directory
+    if (!dir) {
+      return NextResponse.json({ error: 'path parameter required' }, { status: 400 });
+    }
+
+    try {
+      const resolved = path.resolve(dir);
+      const entries = fs.readdirSync(resolved, { withFileTypes: true });
+
+      const items = entries
+        .filter(e => !IGNORE.has(e.name) && !e.name.startsWith('.'))
+        .map(e => ({
+          name: e.name,
+          path: path.join(resolved, e.name),
+          isDir: e.isDirectory(),
+          ext: e.isDirectory() ? null : path.extname(e.name).toLowerCase(),
+        }))
+        .sort((a, b) => {
+          if (a.isDir !== b.isDir) return a.isDir ? -1 : 1;
+          return a.name.localeCompare(b.name);
+        });
+
+      return NextResponse.json({
+        current: resolved,
+        parent: path.dirname(resolved),
+        items,
+      });
+    } catch {
+      return NextResponse.json({ error: 'Cannot read directory' }, { status: 404 });
+    }
+  });
+}
+
+export async function POST(request: NextRequest) {
+  const user = getAuthUser(request);
+  return withUser(user, async () => {
+    try {
+      const formData = await request.formData();
+      const dir = formData.get('dir') as string;
+      if (!dir) return NextResponse.json({ error: 'dir required' }, { status: 400 });
+
+      const resolved = path.resolve(dir);
+      if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {
+        return NextResponse.json({ error: 'Directory not found' }, { status: 404 });
+      }
+
+      const files = formData.getAll('files') as File[];
+      if (files.length === 0) return NextResponse.json({ error: 'No files provided' }, { status: 400 });
+
+      const saved: string[] = [];
+      for (const file of files) {
+        // Sanitize filename — strip path separators to prevent traversal
+        const safeName = file.name.replace(/[/\\]/g, '_');
+        if (!safeName || safeName === '.' || safeName === '..') continue;
+
+        const destPath = path.join(resolved, safeName);
+        const buffer = Buffer.from(await file.arrayBuffer());
+        fs.writeFileSync(destPath, buffer);
+        saved.push(safeName);
+      }
+
+      return NextResponse.json({ uploaded: saved.length, files: saved });
+    } catch (err) {
+      return NextResponse.json({ error: 'Upload failed' }, { status: 500 });
+    }
+  });
+}

package/.next/standalone/src/app/api/folders/route.ts

@@ -1,97 +1,107 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { getAuthUser } from '@/lib/auth';
-import { readConfig } from '@/lib/config';
-import fs from 'fs';
-import path from 'path';
-
-export async function GET(request: NextRequest) {
-  const user = getAuthUser(request);
-  const userHome = require('os').homedir();
-  const config = readConfig(user);
-  const devDirs = (config.devDirectories.length > 0 ? config.devDirectories : [userHome])
-    .map(d => path.resolve(d));
-
-  const dir = request.nextUrl.searchParams.get('path') || devDirs[0];
-
-  try {
-    const resolved = path.resolve(dir);
-
-    // Validate the path is within an allowed dev directory
-    const allowedRoot = devDirs.find(d => resolved === d || resolved.startsWith(d + path.sep));
-    if (!allowedRoot) {
-      return NextResponse.json({ current: dir, parent: null, folders: [], error: 'Access denied' }, { status: 403 });
-    }
-
-    const entries = fs.readdirSync(resolved, { withFileTypes: true });
-
-    const folders = entries
-      .filter(e => {
-        if (!e.isDirectory()) return false;
-        if (e.name.startsWith('.') || e.name === 'node_modules') return false;
-        return true;
-      })
-      .map(e => ({
-        name: e.name,
-        path: path.join(resolved, e.name),
-      }))
-      .sort((a, b) => a.name.localeCompare(b.name));
-
-    // Prevent navigating above the dev directory root
-    const parent = path.dirname(resolved);
-    const isAtRoot = resolved === allowedRoot;
-
-    return NextResponse.json({
-      current: resolved,
-      parent: isAtRoot ? null : parent,
-      folders,
-    });
-  } catch {
-    return NextResponse.json({ current: dir, parent: null, folders: [], error: 'Cannot read directory' });
-  }
-}
-
-export async function POST(request: NextRequest) {
-  const user = getAuthUser(request);
-  const config = readConfig(user);
-  const userHome = require('os').homedir();
-  const devDirs = (config.devDirectories.length > 0 ? config.devDirectories : [userHome])
-    .map((d: string) => path.resolve(d));
-
-  try {
-    const body = await request.json();
-    const { parent, name } = body;
-
-    if (!parent || !name) {
-      return NextResponse.json({ error: 'parent and name are required' }, { status: 400 });
-    }
-
-    // Validate name
-    if (name.includes('/') || name.includes('\\') || name === '.' || name === '..') {
-      return NextResponse.json({ error: 'Invalid folder name' }, { status: 400 });
-    }
-    if (name.length > 255) {
-      return NextResponse.json({ error: 'Folder name too long' }, { status: 400 });
-    }
-
-    const resolvedParent = path.resolve(parent);
-
-    // Validate parent is within allowed dev directories
-    const allowedRoot = devDirs.find((d: string) => resolvedParent === d || resolvedParent.startsWith(d + path.sep));
-    if (!allowedRoot) {
-      return NextResponse.json({ error: 'Access denied' }, { status: 403 });
-    }
-
-    const newPath = path.join(resolvedParent, name);
-
-    // Check if already exists
-    if (fs.existsSync(newPath)) {
-      return NextResponse.json({ error: 'Folder already exists' }, { status: 409 });
-    }
-
-    fs.mkdirSync(newPath, { recursive: true });
-
-    return NextResponse.json({ path: newPath }, { status: 201 });
-  } catch {
-    return NextResponse.json({ error: 'Failed to create folder' }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { getAuthUser } from '@/lib/auth';
+import { readConfig } from '@/lib/config';
+import { lookupShellUser, resolveHome, execAsUser } from '@/lib/shell-user';
+import fs from 'fs';
+import path from 'path';
+
+export async function GET(request: NextRequest) {
+  const user = getAuthUser(request);
+  const shellUser = lookupShellUser(user);
+  const userHome = resolveHome(shellUser);
+  const config = readConfig(user);
+  const devDirs = (config.devDirectories.length > 0 ? config.devDirectories : [userHome])
+    .map(d => path.resolve(d));
+
+  const dir = request.nextUrl.searchParams.get('path') || devDirs[0];
+
+  try {
+    const resolved = path.resolve(dir);
+
+    // Validate the path is within an allowed dev directory
+    const allowedRoot = devDirs.find(d => resolved === d || resolved.startsWith(d + path.sep));
+    if (!allowedRoot) {
+      return NextResponse.json({ current: dir, parent: null, folders: [], error: 'Access denied' }, { status: 403 });
+    }
+
+    const entries = fs.readdirSync(resolved, { withFileTypes: true });
+
+    const folders = entries
+      .filter(e => {
+        if (!e.isDirectory()) return false;
+        if (e.name.startsWith('.') || e.name === 'node_modules') return false;
+        return true;
+      })
+      .map(e => ({
+        name: e.name,
+        path: path.join(resolved, e.name),
+      }))
+      .sort((a, b) => a.name.localeCompare(b.name));
+
+    // Prevent navigating above the dev directory root
+    const parent = path.dirname(resolved);
+    const isAtRoot = resolved === allowedRoot;
+
+    return NextResponse.json({
+      current: resolved,
+      parent: isAtRoot ? null : parent,
+      folders,
+    });
+  } catch {
+    return NextResponse.json({ current: dir, parent: null, folders: [], error: 'Cannot read directory' });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  const user = getAuthUser(request);
+  const shellUser = lookupShellUser(user);
+  const userHome = resolveHome(shellUser);
+  const config = readConfig(user);
+  const devDirs = (config.devDirectories.length > 0 ? config.devDirectories : [userHome])
+    .map((d: string) => path.resolve(d));
+
+  try {
+    const body = await request.json();
+    const { parent, name } = body;
+
+    if (!parent || !name) {
+      return NextResponse.json({ error: 'parent and name are required' }, { status: 400 });
+    }
+
+    // Validate name
+    if (name.includes('/') || name.includes('\\') || name === '.' || name === '..') {
+      return NextResponse.json({ error: 'Invalid folder name' }, { status: 400 });
+    }
+    if (name.length > 255) {
+      return NextResponse.json({ error: 'Folder name too long' }, { status: 400 });
+    }
+
+    const resolvedParent = path.resolve(parent);
+
+    // Validate parent is within allowed dev directories
+    const allowedRoot = devDirs.find((d: string) => resolvedParent === d || resolvedParent.startsWith(d + path.sep));
+    if (!allowedRoot) {
+      return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+    }
+
+    const newPath = path.join(resolvedParent, name);
+
+    if (fs.existsSync(newPath)) {
+      return NextResponse.json({ error: 'Folder already exists' }, { status: 409 });
+    }
+
+    // Create the directory as the authenticated shell user, not as the server process user.
+    // Otherwise a mkdir inside another user's home fails with EACCES.
+    const result = execAsUser(shellUser, ['mkdir', '--', newPath]);
+    if (result.status !== 0) {
+      const msg = (result.stderr || '').trim() || 'Failed to create folder';
+      const status = /exists/i.test(msg) ? 409 : /permission|denied/i.test(msg) ? 403 : 500;
+      return NextResponse.json({ error: msg }, { status });
+    }
+
+    return NextResponse.json({ path: newPath }, { status: 201 });
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : 'Failed to create folder';
+    return NextResponse.json({ error: msg }, { status: 500 });
+  }
+}

package/.next/standalone/src/app/api/network/connect-callback/route.ts

@@ -1,11 +1,11 @@
-import { NextRequest } from 'next/server';
-import { getPro } from '@/lib/pro';
-
-const notAvailable = () =>
-  Response.json({ error: 'Not available' }, { status: 404 });
-
-export async function POST(req: NextRequest) {
-  const pro = getPro();
-  const handler = pro?.network?.api?.connectCallback?.POST;
-  return handler ? handler(req) : notAvailable();
-}
+import { NextRequest } from 'next/server';
+import { getPro } from '@/lib/pro';
+
+const notAvailable = () =>
+  Response.json({ error: 'Not available' }, { status: 404 });
+
+export async function POST(req: NextRequest) {
+  const pro = getPro();
+  const handler = pro?.network?.api?.connectCallback?.POST;
+  return handler ? handler(req) : notAvailable();
+}

package/.next/standalone/src/app/api/network/connect-request/[id]/route.ts

@@ -1,11 +1,11 @@
-import { NextRequest } from 'next/server';
-import { getPro } from '@/lib/pro';
-
-const notAvailable = () =>
-  Response.json({ error: 'Not available' }, { status: 404 });
-
-export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
-  const pro = getPro();
-  const handler = pro?.network?.api?.connectRequestById?.PUT;
-  return handler ? handler(req, ctx) : notAvailable();
-}
+import { NextRequest } from 'next/server';
+import { getPro } from '@/lib/pro';
+
+const notAvailable = () =>
+  Response.json({ error: 'Not available' }, { status: 404 });
+
+export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
+  const pro = getPro();
+  const handler = pro?.network?.api?.connectRequestById?.PUT;
+  return handler ? handler(req, ctx) : notAvailable();
+}