@kabmo-labs/kabmo 0.0.0-stage → 0.0.1

package/src/server/routes/folders/routes.test.ts

@@ -0,0 +1,185 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The two creation paths the New Workspace modal drives.
+ *
+ * `/api/folders` already had a workspace, so its cases here pin the behaviour
+ * the SHARED insert moved into `register-folder.server.ts` — the tombstone
+ * clear and the case-insensitive name guard — because a refactor that quietly
+ * dropped either would only show up as a workspace that reappears (or refuses
+ * to) on a later boot.
+ *
+ * `/api/folders/mkdir` is new and its refusals are the interesting half: a name
+ * carrying a separator must not reach the filesystem, an existing name must be
+ * reported rather than adopted, and a missing parent must be named as such
+ * instead of being created. The parent is a real temp directory, because the
+ * route validates an absolute path rather than a `resolveRoot` scope — the
+ * whole reason it is not `/api/fs/action`'s `create`.
+ */
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from 'bun:test';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { getDb } from '@/server/db.server';
+import { action as createAction } from '@/server/routes/folders/create';
+import { action as mkdirAction } from '@/server/routes/folders/mkdir';
+import { removeDir } from '@/test-support/remove-dir';
+
+// `tmpdir()` rather than a literal `/tmp`: on Windows there is no `/tmp`, so a
+// POSIX-literal root makes every write land at a path the OS resolves against
+// the current drive — the fixture directories never exist where the route looks
+// for them, and the request fails for a reason unrelated to what is under test.
+const ROOT = path.join(os.tmpdir(), 'omc-folders-routes-test');
+const WORKSPACE = path.join(ROOT, 'projects');
+
+function post(url: string, body: unknown): Request {
+  return new Request(url, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+}
+
+async function call(handler: typeof createAction, url: string, body: unknown) {
+  const res = (await handler({ request: post(url, body), params: {} } as never)) as Response;
+  return { status: res.status, body: (await res.json()) as Record<string, unknown> };
+}
+
+/** The folder name a creation response carries, narrowed rather than cast. */
+function folderName(body: Record<string, unknown>): string {
+  const folder = body.folder;
+  if (folder && typeof folder === 'object' && 'name' in folder && typeof folder.name === 'string') {
+    return folder.name;
+  }
+  throw new Error(`response carried no folder name: ${JSON.stringify(body)}`);
+}
+
+beforeAll(async () => {
+  removeDir(ROOT);
+  fs.mkdirSync(WORKSPACE, { recursive: true });
+  Bun.env.PI_CODING_AGENT_DIR = path.join(ROOT, 'agent');
+  Bun.env.KABMO_DB_PATH = path.join(ROOT, 'db.sqlite');
+  Bun.env.SYNC_WORKSPACE = 'false';
+  delete Bun.env.MOCK;
+  globalThis.__kabmoDb = undefined;
+  await getDb();
+});
+
+afterEach(async () => {
+  delete Bun.env.MOCK;
+  // The mkdir cases write real directories, so the tree is reset with the rows
+  // — otherwise a later case asserts against a listing an earlier one filled.
+  for (const entry of fs.readdirSync(WORKSPACE)) {
+    fs.rmSync(path.join(WORKSPACE, entry), { recursive: true, force: true });
+  }
+  const db = await getDb();
+  await db.run('DELETE FROM workspace_folders');
+  await db.run('DELETE FROM deleted_workspaces');
+});
+
+afterAll(() => {
+  globalThis.__kabmoDb?.resolved?.raw.close();
+  globalThis.__kabmoDb = undefined;
+  delete Bun.env.PI_CODING_AGENT_DIR;
+  delete Bun.env.KABMO_DB_PATH;
+  delete Bun.env.SYNC_WORKSPACE;
+  delete Bun.env.MOCK;
+  removeDir(ROOT);
+});
+
+describe('POST /api/folders/mkdir', () => {
+  test('creates one subdirectory of the named parent and reports its path', async () => {
+    const { status, body } = await call(mkdirAction, 'http://localhost/api/folders/mkdir', {
+      parent: WORKSPACE,
+      name: 'fresh-folder',
+    });
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true, path: path.join(WORKSPACE, 'fresh-folder'), name: 'fresh-folder' });
+    expect(fs.statSync(path.join(WORKSPACE, 'fresh-folder')).isDirectory()).toBe(true);
+  });
+
+  test('refuses a name carrying a separator, so the parent is the only location', async () => {
+    for (const name of ['../escape', 'sub/escape', 'sub\\escape', '..', '.']) {
+      const { status } = await call(mkdirAction, 'http://localhost/api/folders/mkdir', {
+        parent: WORKSPACE,
+        name,
+      });
+      expect(status).toBe(400);
+    }
+    expect(fs.readdirSync(WORKSPACE)).toEqual([]);
+  });
+
+  test('reports an existing name rather than adopting it', async () => {
+    fs.mkdirSync(path.join(WORKSPACE, 'taken'));
+    const { status, body } = await call(mkdirAction, 'http://localhost/api/folders/mkdir', {
+      parent: WORKSPACE,
+      name: 'taken',
+    });
+
+    expect(status).toBe(409);
+    expect(body.error).toBe('taken already exists');
+  });
+
+  test('names a missing parent as such instead of creating the tree', async () => {
+    const missing = path.join(WORKSPACE, 'not-there');
+    const { status, body } = await call(mkdirAction, 'http://localhost/api/folders/mkdir', {
+      parent: missing,
+      name: 'child',
+    });
+
+    expect(status).toBe(400);
+    expect(body.code).toBe('parent_not_a_directory');
+    expect(fs.existsSync(missing)).toBe(false);
+  });
+
+  test('refuses under MOCK, where there is no filesystem to write to', async () => {
+    Bun.env.MOCK = 'true';
+    const { status } = await call(mkdirAction, 'http://localhost/api/folders/mkdir', {
+      parent: WORKSPACE,
+      name: 'mock-folder',
+    });
+
+    expect(status).toBe(400);
+    expect(fs.existsSync(path.join(WORKSPACE, 'mock-folder'))).toBe(false);
+  });
+});
+
+describe('POST /api/folders', () => {
+  test('clears a tombstone for the same project path so the folder survives the next boot', async () => {
+    const db = await getDb();
+    await db.run('INSERT INTO deleted_workspaces (project_path) VALUES (?)', [WORKSPACE]);
+
+    const { status, body } = await call(createAction, 'http://localhost/api/folders', {
+      name: 'Projects',
+      path: WORKSPACE,
+    });
+
+    expect(status).toBe(200);
+    expect(body.success).toBe(true);
+    const tombstones = await db.all('SELECT project_path FROM deleted_workspaces');
+    expect(tombstones).toEqual([]);
+  });
+
+  test('refuses a second folder with the same name, case-insensitively', async () => {
+    await call(createAction, 'http://localhost/api/folders', { name: 'Projects', path: WORKSPACE });
+    const { status, body } = await call(createAction, 'http://localhost/api/folders', {
+      name: 'projects',
+      path: WORKSPACE,
+    });
+
+    expect(status).toBe(400);
+    expect(body.code).toBe('duplicate_name');
+  });
+
+  test('derives the name from the directory when none was given', async () => {
+    const { status, body } = await call(createAction, 'http://localhost/api/folders', { path: WORKSPACE });
+
+    expect(status).toBe(200);
+    expect(folderName(body)).toBe('projects');
+  });
+});

package/src/server/routes/fs/action-create.test.ts

@@ -0,0 +1,90 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The Files panel's "New file" branch.
+ *
+ * Two rules are load-bearing and neither is visible from the happy path: the
+ * name may not carry a path separator (the folder is named by `path`, and a
+ * separator would turn a name into an arbitrary write under the root), and an
+ * existing file is REFUSED rather than truncated. The second one is the one a
+ * naive `Bun.write` gets wrong: `Bun.write` creates or truncates, so a name
+ * that collides with a real file would silently blank it.
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import fs from 'fs';
+import path from 'path';
+import { action } from '@/server/routes/fs/action';
+
+/** Probes live in the repo root — the one directory the root allow-list always accepts. */
+const DIR = path.join(process.cwd(), 'tmp-create-probe');
+const NESTED = path.join(DIR, 'sub');
+
+afterEach(() => {
+  fs.rmSync(DIR, { recursive: true, force: true });
+});
+
+async function create(folderPath: string, name: string) {
+  const form = new FormData();
+  form.append('actionType', 'create');
+  form.append('root', process.cwd());
+  form.append('path', folderPath);
+  form.append('name', name);
+  const res = await action({ request: new Request('http://localhost/api/fs/action', { method: 'POST', body: form }) } as never);
+  return { status: res.status, body: (await res.json()) as { success?: boolean; path?: string; error?: string } };
+}
+
+describe('fs create', () => {
+  test('creates an empty file in the named folder and reports its relative path', async () => {
+    fs.mkdirSync(DIR, { recursive: true });
+    const { status, body } = await create('tmp-create-probe', 'notes.md');
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true, path: 'tmp-create-probe/notes.md' });
+    expect(fs.readFileSync(path.join(DIR, 'notes.md'), 'utf8')).toBe('');
+  });
+
+  test('creates inside a nested folder path, which is how a subfolder is targeted', async () => {
+    fs.mkdirSync(NESTED, { recursive: true });
+    const { status, body } = await create('tmp-create-probe/sub', 'index.ts');
+
+    expect(status).toBe(200);
+    expect(body.path).toBe('tmp-create-probe/sub/index.ts');
+    expect(fs.existsSync(path.join(NESTED, 'index.ts'))).toBe(true);
+  });
+
+  test('refuses an existing name instead of truncating it', async () => {
+    fs.mkdirSync(DIR, { recursive: true });
+    fs.writeFileSync(path.join(DIR, 'keep.txt'), 'important');
+
+    const { status, body } = await create('tmp-create-probe', 'keep.txt');
+
+    expect(status).toBe(409);
+    expect(body.error).toContain('already exists');
+    expect(fs.readFileSync(path.join(DIR, 'keep.txt'), 'utf8')).toBe('important');
+  });
+
+  test('refuses a name carrying a path separator', async () => {
+    fs.mkdirSync(DIR, { recursive: true });
+    for (const name of ['../escape.txt', 'sub/escape.txt', 'sub\\escape.txt']) {
+      const { status } = await create('tmp-create-probe', name);
+      expect(status).toBe(400);
+    }
+    expect(fs.existsSync(path.join(process.cwd(), 'escape.txt'))).toBe(false);
+  });
+
+  test('refuses an empty or whitespace-only name', async () => {
+    fs.mkdirSync(DIR, { recursive: true });
+    expect((await create('tmp-create-probe', '   ')).status).toBe(400);
+    expect((await create('tmp-create-probe', '.')).status).toBe(400);
+    expect((await create('tmp-create-probe', '..')).status).toBe(400);
+  });
+
+  test('refuses a folder that resolves outside the root', async () => {
+    const { status } = await create('../outside', 'x.txt');
+    expect(status).toBe(403);
+  });
+});

package/src/server/routes/fs/action-transfer.test.ts

@@ -0,0 +1,159 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The Files panel's transfer actions at the route: `duplicate` and `paste`.
+ *
+ * The refusals are the point, and each one is a rule a client could otherwise
+ * skip: a paste that names a source outside the scoped root, a folder pasted
+ * into its own subtree, and a paste whose clipboard entry was deleted between
+ * the copy and the paste. The overwrite rule belongs to `transfer.ts` and is
+ * asserted there; this file asserts that the ROUTE reaches it — a transfer that
+ * resolved to the wrong paths would still "succeed" while writing somewhere the
+ * user never named.
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { action } from '@/server/routes/fs/action';
+
+/** Probes live in the repo root — the one directory the root allow-list always accepts. */
+const DIR = path.join(process.cwd(), 'tmp-fs-transfer-probe');
+
+/** Write each `dir-relative` file under the repo root, keyed by its full relative path. */
+function reset(files: Record<string, string>): void {
+  fs.rmSync(DIR, { recursive: true, force: true });
+  for (const [rel, content] of Object.entries(files)) {
+    const target = path.join(process.cwd(), rel);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, content);
+  }
+}
+
+afterEach(() => {
+  fs.rmSync(DIR, { recursive: true, force: true });
+});
+
+async function post(fields: Record<string, string>) {
+  const form = new FormData();
+  form.append('root', process.cwd());
+  for (const [key, value] of Object.entries(fields)) form.append(key, value);
+  const res = await action({ request: new Request('http://localhost/api/fs/action', { method: 'POST', body: form }) } as never);
+  return { status: res.status, body: (await res.json()) as { success?: boolean; path?: string; error?: string } };
+}
+
+describe('fs duplicate', () => {
+  test('copies a file beside itself and reports the name it chose', async () => {
+    reset({ 'tmp-fs-transfer-probe/a.ts': 'A', 'tmp-fs-transfer-probe/a copy.ts': 'C1' });
+
+    const { status, body } = await post({ actionType: 'duplicate', path: 'tmp-fs-transfer-probe/a.ts' });
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true, path: 'tmp-fs-transfer-probe/a copy 2.ts' });
+    expect(fs.readFileSync(path.join(DIR, 'a copy 2.ts'), 'utf8')).toBe('A');
+  });
+
+  test('copies a folder tree', async () => {
+    reset({ 'tmp-fs-transfer-probe/src/a.ts': 'A' });
+
+    const { body } = await post({ actionType: 'duplicate', path: 'tmp-fs-transfer-probe/src' });
+
+    expect(body.path).toBe('tmp-fs-transfer-probe/src copy');
+    expect(fs.readFileSync(path.join(DIR, 'src copy/a.ts'), 'utf8')).toBe('A');
+  });
+});
+
+describe('fs paste', () => {
+  test('a cut moves the entry into the named folder', async () => {
+    reset({ 'tmp-fs-transfer-probe/a.ts': 'A', 'tmp-fs-transfer-probe/dest/.keep': '' });
+
+    const { status, body } = await post({
+      actionType: 'paste',
+      sourcePath: 'tmp-fs-transfer-probe/a.ts',
+      mode: 'cut',
+      targetPath: 'tmp-fs-transfer-probe/dest',
+      targetKind: 'folder',
+    });
+
+    expect(status).toBe(200);
+    expect(body).toEqual({ success: true, path: 'tmp-fs-transfer-probe/dest/a.ts' });
+    expect(fs.existsSync(path.join(DIR, 'a.ts'))).toBe(false);
+    expect(fs.readFileSync(path.join(DIR, 'dest/a.ts'), 'utf8')).toBe('A');
+  });
+
+  test('a paste onto a FILE lands in that file’s own directory', async () => {
+    reset({ 'tmp-fs-transfer-probe/a.ts': 'A', 'tmp-fs-transfer-probe/dest/b.ts': 'B' });
+
+    const { body } = await post({
+      actionType: 'paste',
+      sourcePath: 'tmp-fs-transfer-probe/a.ts',
+      mode: 'copy',
+      targetPath: 'tmp-fs-transfer-probe/dest/b.ts',
+      targetKind: 'file',
+    });
+
+    expect(body).toEqual({ success: true, path: 'tmp-fs-transfer-probe/dest/a.ts' });
+  });
+
+  test('a paste onto the listing root background lands at the top of the tree', async () => {
+    reset({ 'tmp-fs-transfer-probe/dest/a.ts': 'A' });
+
+    const { body } = await post({
+      actionType: 'paste',
+      sourcePath: 'tmp-fs-transfer-probe/dest/a.ts',
+      mode: 'cut',
+      targetPath: 'tmp-fs-transfer-probe',
+      targetKind: 'folder',
+    });
+
+    expect(body).toEqual({ success: true, path: 'tmp-fs-transfer-probe/a.ts' });
+    expect(fs.readFileSync(path.join(DIR, 'a.ts'), 'utf8')).toBe('A');
+  });
+
+  test('refuses a folder pasted into its own subtree', async () => {
+    reset({ 'tmp-fs-transfer-probe/src/a.ts': 'A', 'tmp-fs-transfer-probe/src/deep/.keep': '' });
+
+    const { status, body } = await post({
+      actionType: 'paste',
+      sourcePath: 'tmp-fs-transfer-probe/src',
+      mode: 'copy',
+      targetPath: 'tmp-fs-transfer-probe/src/deep',
+      targetKind: 'folder',
+    });
+
+    expect(status).toBe(409);
+    expect(body.error).toContain('itself');
+  });
+
+  test('refuses a source outside the scoped root', async () => {
+    reset({ 'tmp-fs-transfer-probe/a.ts': 'A' });
+
+    const { status } = await post({
+      actionType: 'paste',
+      sourcePath: '../outside.ts',
+      mode: 'copy',
+      targetPath: 'tmp-fs-transfer-probe',
+      targetKind: 'folder',
+    });
+
+    expect(status).toBe(403);
+  });
+
+  test('reports a clipboard entry that no longer exists instead of pasting nothing', async () => {
+    reset({ 'tmp-fs-transfer-probe/dest/.keep': '' });
+
+    const { status, body } = await post({
+      actionType: 'paste',
+      sourcePath: 'tmp-fs-transfer-probe/gone.ts',
+      mode: 'copy',
+      targetPath: 'tmp-fs-transfer-probe/dest',
+      targetKind: 'folder',
+    });
+
+    expect(status).toBe(404);
+    expect(body.error).toContain('no longer exists');
+  });
+});

package/src/server/routes/fs/action.test.ts

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The save branch's byte contract.
+ *
+ * `multipart/form-data` normalizes every bare LF in a field value to CRLF in
+ * transit — the HTML serializer does it on the way out and Bun's parser agrees
+ * on the way in — so `content` reaches this route CRLF-normalized no matter what
+ * the editor buffer held. The file's own ending therefore arrives as its own
+ * `eol` field, and the bytes written to disk are built from it. Without that
+ * step every save rewrote the whole file's line endings: an LF file came back
+ * CRLF, which `git diff` reports as every line changed.
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import fs from 'fs';
+import path from 'path';
+import { action } from '@/server/routes/fs/action';
+
+/** Probe files live in the repo root — the one directory the root allow-list always accepts. */
+const PROBE = path.join(process.cwd(), 'tmp-eol-probe.txt');
+
+afterEach(() => {
+  fs.rmSync(PROBE, { force: true });
+});
+
+async function save(content: string, eol?: string) {
+  const form = new FormData();
+  form.append('actionType', 'save');
+  form.append('root', process.cwd());
+  form.append('path', 'tmp-eol-probe.txt');
+  form.append('content', content);
+  if (eol) form.append('eol', eol);
+  const res = await action({ request: new Request('http://localhost/api/fs/action', { method: 'POST', body: form }) } as never);
+  expect(res.status).toBe(200);
+  return new Uint8Array(await Bun.file(PROBE).arrayBuffer());
+}
+
+describe('fs save line endings', () => {
+  test('an lf request writes lf, whatever multipart did in transit', async () => {
+    const bytes = await save('a\nb\n', 'lf');
+    expect([...bytes]).toEqual([0x61, 0x0a, 0x62, 0x0a]);
+  });
+
+  test('a crlf request writes crlf', async () => {
+    const bytes = await save('a\nb\n', 'crlf');
+    expect([...bytes]).toEqual([0x61, 0x0d, 0x0a, 0x62, 0x0d, 0x0a]);
+  });
+
+  test('a payload that already carries crlf is not doubled', async () => {
+    const bytes = await save('a\r\nb\r\n', 'crlf');
+    expect([...bytes]).toEqual([0x61, 0x0d, 0x0a, 0x62, 0x0d, 0x0a]);
+  });
+
+  // No `eol` means the route has no instruction, so the payload is written as
+  // multipart delivered it — which is CRLF, since the transport normalizes.
+  test('a payload without an eol field is written as delivered', async () => {
+    const bytes = await save('a\nb\n');
+    expect([...bytes]).toEqual([0x61, 0x0d, 0x0a, 0x62, 0x0d, 0x0a]);
+  });
+});

package/src/server/routes/fs/action.ts

@@ -0,0 +1,175 @@
+import { json, type ActionFunctionArgs } from '@/server/lib/remix-compat';
+import { errorResponse } from '@/server/lib/route-adapter';
+import fs from 'fs';
+import path from 'path';
+import { isMockMode } from '@/server/mock.server';
+import { getDefaultFsRoot, resolveRoot, resolveWithinRoot } from '@/server/lib/fs/root';
+import { runShell } from '@/server/lib/fs/shell';
+import { revealInFileManager } from '@/server/lib/fs/reveal';
+import { duplicateEntry, nextDuplicateName, pasteEntry } from '@/server/lib/fs/transfer';
+import { transferRefusal } from '@/shared/lib/fs/clipboard';
+import { toDiskText } from '@/shared/lib/code/line-endings';
+
+/** The two shapes a transfer action answers with, ready for `json`. */
+function transferResponse(outcome: { path?: string; error?: string; status?: number }) {
+  if (outcome.error) return json({ error: outcome.error }, { status: outcome.status ?? 400 });
+  return json({ success: true, path: outcome.path });
+}
+
+/**
+ * The `duplicate` action: copy an entry beside itself under the `a copy.txt`
+ * naming ladder.
+ *
+ * The name is chosen from the source's real directory listing (not a probe that
+ * races the write), so the answer the panel renders and the file that landed
+ * are the same name.
+ */
+async function runDuplicateAction(options: { filePath: string; scopedRoot: string }) {
+  const { filePath, scopedRoot } = options;
+  const source = resolveWithinRoot(scopedRoot, filePath);
+  if (!source) return json({ error: 'Invalid path' }, { status: 403 });
+  const kind = (await Bun.file(source).stat().catch(() => null))?.isDirectory() ? 'folder' : 'file';
+  const destinationName = await nextDuplicateName(source, kind);
+  return transferResponse(await duplicateEntry({ scopedRoot, sourcePath: source, destinationName }));
+}
+
+/**
+ * `Paste` carries the clipboard ENTRY, not just its destination: the entry is
+ * what the rule checks (a folder may not land in its own subtree) and what the
+ * source path is resolved from, so the client cannot ask the server to move an
+ * arbitrary pair of paths.
+ *
+ * The SCOPE half of `pasteRefusal` is deliberately not re-checked here: the
+ * client's scope is built from the un-resolved `rootPath` (which may be
+ * `~`-relative) while this side holds the resolved directory, so the two are
+ * not comparable. `transferRefusal` is the half both ends can enforce.
+ */
+async function runPasteAction(options: { formData: FormData; scopedRoot: string }) {
+  const { formData, scopedRoot } = options;
+  const mode = formData.get('mode') === 'cut' ? 'cut' : 'copy';
+  const sourceRel = ((formData.get('sourcePath') as string) ?? '').trim();
+  const sourcePath = resolveWithinRoot(scopedRoot, sourceRel);
+  if (!sourcePath) return json({ error: 'Invalid path' }, { status: 403 });
+  const sourceStat = await Bun.file(sourcePath).stat().catch(() => null);
+  if (!sourceStat) return json({ error: 'The entry on the clipboard no longer exists' }, { status: 404 });
+  const rawTarget = ((formData.get('targetPath') as string) ?? '').trim() || '.';
+  const rawTargetKind = formData.get('targetKind') === 'folder' ? 'folder' : 'file';
+  const targetDir = rawTargetKind === 'folder' ? rawTarget : path.dirname(rawTarget);
+  const refusal = transferRefusal(
+    { path: sourceRel, kind: sourceStat.isDirectory() ? 'folder' : 'file' },
+    targetDir,
+  );
+  if (refusal) return json({ error: refusal }, { status: 409 });
+  const fullDir = resolveWithinRoot(scopedRoot, targetDir);
+  if (!fullDir) return json({ error: 'Invalid path' }, { status: 403 });
+  return transferResponse(await pasteEntry({ scopedRoot, sourcePath, destinationDir: fullDir, mode }));
+}
+
+export async function action({ request }: ActionFunctionArgs) {
+  const formData = await request.formData();
+  const actionType = formData.get('actionType') as string;
+  const filePath = formData.get('path') as string;
+
+  const rootDir = await resolveRoot(formData.get('root') as string, await getDefaultFsRoot(isMockMode()));
+  const repo = (formData.get('repo') as string) || '.';
+  const scopedRoot = repo === '.' ? rootDir : resolveWithinRoot(rootDir, repo);
+  if (!scopedRoot) {
+    return json({ error: 'Invalid repo path' }, { status: 403 });
+  }
+
+  try {
+    if (actionType === 'duplicate') {
+      return await runDuplicateAction({ filePath, scopedRoot });
+    }
+    if (actionType === 'paste') {
+      return await runPasteAction({ formData, scopedRoot });
+    }
+
+    const fullPath = resolveWithinRoot(scopedRoot, filePath);
+
+    if (!fullPath) {
+      return json({ error: 'Invalid path' }, { status: 403 });
+    }
+    if (actionType === 'save') {
+      const raw = (formData.get('content') as string) ?? '';
+      const eol = formData.get('eol');
+      // The bytes are built here rather than written verbatim: `multipart/
+      // form-data` normalizes every bare LF in a field value to CRLF in transit
+      // (the HTML serializer does it on the way out, Bun's parser agrees on the
+      // way in — same result either way), so an LF file would land on disk as
+      // CRLF and show up as a full-file diff. `eol` is the ending the client
+      // read the file with; without it the payload is written untouched.
+      const content = eol === 'crlf' || eol === 'lf' ? toDiskText(raw, eol) : raw;
+      await fs.promises.mkdir(path.dirname(fullPath), { recursive: true });
+      await Bun.write(fullPath, content);
+      return json({ success: true });
+    } else if (actionType === 'create') {
+      // The Files panel's "New file": an empty file beside the folder that was
+      // right-clicked. Only a NAME is accepted, never a path — a separator
+      // would let the panel write anywhere under the root, and the folder is
+      // already named by `path`.
+      const name = ((formData.get('name') as string) ?? '').trim();
+      if (!name || name === '.' || name === '..' || /[/\\\0]/.test(name)) {
+        return json({ error: 'Enter a file name without slashes' }, { status: 400 });
+      }
+      const target = resolveWithinRoot(scopedRoot, path.join(filePath || '.', name));
+      if (!target) {
+        return json({ error: 'Invalid path' }, { status: 403 });
+      }
+      // Creating must never overwrite: a name that already exists is reported,
+      // not truncated — the panel offers Rename for that, and an empty write
+      // here would destroy the file the user meant to keep.
+      if ((await Bun.file(target).stat().catch(() => null)) !== null) {
+        return json({ error: `${name} already exists` }, { status: 409 });
+      }
+      await fs.promises.mkdir(path.dirname(target), { recursive: true });
+      await Bun.write(target, '');
+      // Relative to the LISTED root, which is the identity the tree renders by.
+      return json({ success: true, path: path.relative(scopedRoot, target).split(path.sep).join('/') });
+    } else if (actionType === 'delete') {
+      await fs.promises.rm(fullPath, { recursive: true, force: true });
+      return json({ success: true });
+    } else if (actionType === 'rename') {
+      const newPath = formData.get('newPath') as string;
+      const fullNewPath = path.resolve(rootDir, newPath);
+      if (fullNewPath !== rootDir && !fullNewPath.startsWith(rootDir + path.sep)) {
+        return json({ error: 'Invalid new path' }, { status: 403 });
+      }
+      await fs.promises.rename(fullPath, fullNewPath);
+      return json({ success: true });
+    } else if (actionType === 'open_explorer') {
+      const isDir = (await Bun.file(fullPath).stat().catch(() => null))?.isDirectory() ?? false;
+      // A file reveals its containing directory — there is no portable "select
+      // this file" — so the opener is always handed a directory.
+      const result = await revealInFileManager(isDir ? fullPath : path.dirname(fullPath));
+      return result.ok ? json({ success: true }) : json({ error: result.error }, { status: 500 });
+    } else if (actionType === 'git_history') {
+      const targetDir = scopedRoot;
+      const history = await runShell(
+        `git log -n 50 --date-order --pretty=format:"|~|%h|~|%an|~|%ar|~|%s" -- "${filePath}"`,
+        { cwd: targetDir, maxBuffer: 1024 * 1024 }
+      );
+      if (history.exitCode !== 0 && history.stderr.includes('not a git repository')) {
+        return json({ error: 'Not a git repository' }, { status: 200 });
+      }
+      const parsedData = history.stdout.split('\n').filter(Boolean).map(line => {
+        const parts = line.split('|~|');
+        if (parts.length === 1) {
+          return { graph: '', message: parts[0] };
+        }
+        return {
+          graph: parts[0],
+          hash: parts[1],
+          author: parts[2],
+          time: parts[3],
+          message: parts[4]
+        };
+      });
+      return json({ success: true, type: 'history', data: parsedData });
+    }
+    
+    return json({ error: 'Unknown action' }, { status: 400 });
+  } catch (error) {
+    return errorResponse(error);
+  }
+}