@mastra/factory 0.0.0-fix-thread-subscription-multi-instance-redis-streams-20260730204150

package/dist/routes/fs.js

@@ -0,0 +1,708 @@
+import { registerApiRoute } from "@mastra/core/server";
+import { isAbsolute, join, posix, resolve, sep } from "path";
+import { lstat, open, readdir, realpath, stat } from "fs/promises";
+import { homedir } from "os";
+import { SandboxFilesystem } from "@mastra/code-sdk/agents/sandbox-filesystem";
+import { detectProject, getResourceIdOverride } from "@mastra/code-sdk/utils/project";
+//#region src/routes/fs.ts
+const MAX_TEXT_FILE_BYTES = 512 * 1024;
+const MAX_DIFF_BYTES = 512 * 1024;
+const WORKSPACE_NUMSTAT_SCRIPT = `
+set -e
+workdir=$1
+index_file=$(mktemp)
+untracked_file=$(mktemp)
+object_dir=$(mktemp -d)
+trap 'rm -f "$index_file" "$untracked_file"; rm -rf "$object_dir"' EXIT
+rm -f "$index_file"
+git -C "$workdir" diff --numstat -z --find-renames --no-ext-diff --no-textconv HEAD
+git -C "$workdir" ls-files --others --exclude-standard -z >"$untracked_file"
+git_dir=$(git -C "$workdir" rev-parse --absolute-git-dir)
+export GIT_INDEX_FILE="$index_file"
+export GIT_OBJECT_DIRECTORY="$object_dir"
+export GIT_ALTERNATE_OBJECT_DIRECTORIES="$git_dir/objects"
+git -C "$workdir" read-tree --empty
+git -C "$workdir" update-index --add -z --stdin <"$untracked_file"
+empty_tree=$(git -C "$workdir" hash-object -t tree /dev/null)
+git -C "$workdir" diff --cached --numstat -z --no-ext-diff --no-textconv "$empty_tree"
+`;
+const BOUNDED_GIT_DIFF_SCRIPT = `
+allow_exit_one=$1
+shift
+status_file=$(mktemp)
+stderr_file=$(mktemp)
+trap 'rm -f "$status_file" "$stderr_file"' EXIT
+(
+  git "$@" 2>"$stderr_file"
+  printf '%s' "$?" >"$status_file"
+) | head -c 524289
+status=$(cat "$status_file")
+case "$status" in
+  0|141) exit 0 ;;
+  1) [ "$allow_exit_one" = "1" ] && exit 0 ;;
+esac
+cat "$stderr_file" >&2
+exit "\${status:-1}"
+`;
+const TEXT_DECODER = new TextDecoder("utf-8", { fatal: true });
+const APPROVED_RENDERED_ROOTS = /* @__PURE__ */ new Set([".artifacts"]);
+/** Erase a route handler's path-parameterized context to a plain `Context`. */
+function loose(c) {
+	return c;
+}
+/** Resolve the browsable root, defaulting to the user's home directory. */
+function resolveFsRoot(root) {
+	return resolve(root && root.trim() ? root : homedir());
+}
+/** True when `candidate` is `root` or nested under it. */
+function isWithinRoot(candidate, root) {
+	if (candidate === root) return true;
+	const rootWithSep = root.endsWith(sep) ? root : root + sep;
+	return candidate.startsWith(rootWithSep);
+}
+async function realOrResolved(path) {
+	try {
+		return await realpath(path);
+	} catch {
+		return path;
+	}
+}
+/**
+* Resolve a path's real location (following symlinks) and confirm it stays
+* within `root`. Returns the real path when confined, or `null` when it escapes
+* the root or does not exist. Used so a symlink inside the root that points
+* outside it cannot be browsed or selected.
+*/
+async function realPathWithinRoot(candidate, root) {
+	try {
+		const real = await realpath(candidate);
+		return isWithinRoot(real, root) ? real : null;
+	} catch {
+		return null;
+	}
+}
+function assertRelativePath(path, label) {
+	const trimmed = path.trim();
+	if (!trimmed) throw new Error(`Missing required query param: ${label}`);
+	if (isAbsolute(trimmed)) throw new Error(`${label} must be relative`);
+	if (trimmed.split(/[\\/]+/).includes("..")) throw new Error(`${label} escapes workspace`);
+	const normalized = resolve("/", trimmed).slice(1);
+	if (!normalized || normalized === ".." || normalized.startsWith(`..${sep}`)) throw new Error(`${label} escapes workspace`);
+	return normalized;
+}
+function assertApprovedRenderedRoot(renderedRoot) {
+	const safeRoot = assertRelativePath(renderedRoot, "root");
+	if (!APPROVED_RENDERED_ROOTS.has(safeRoot)) throw new Error("Root is not approved for rendered workspace access");
+	return safeRoot;
+}
+async function confinedWorkspacePath(root, workspacePath) {
+	const resolvedRoot = await realOrResolved(resolveFsRoot(root));
+	const workspace = await realPathWithinRoot(isAbsolute(workspacePath) ? resolve(workspacePath) : resolve(resolvedRoot, workspacePath), resolvedRoot);
+	if (!workspace) throw new Error("Path is outside the browsable root");
+	return {
+		resolvedRoot,
+		workspace
+	};
+}
+async function confinedWorkspaceRelativePath(root, workspacePath, relativePath) {
+	const safeRelativePath = assertRelativePath(relativePath, "path");
+	const { workspace } = await confinedWorkspacePath(root, workspacePath);
+	const candidate = resolve(workspace, safeRelativePath);
+	if (!isWithinRoot(candidate, workspace)) throw new Error("Path escapes workspace");
+	const confinedPath = await realPathWithinRoot(candidate, workspace);
+	if (!confinedPath) throw new Error("Path is outside the workspace");
+	return {
+		workspace,
+		path: confinedPath,
+		relativePath: safeRelativePath
+	};
+}
+/**
+* List the directories inside `requestedPath`, confined to `root`. An absent or
+* out-of-root path is clamped to the root, so the worst a malicious client can
+* do is browse within the allowed root.
+*/
+async function listDirectory(root, requestedPath) {
+	const resolvedRoot = await realOrResolved(resolveFsRoot(root));
+	let target = resolvedRoot;
+	if (requestedPath && requestedPath.trim()) target = await realPathWithinRoot(isAbsolute(requestedPath) ? resolve(requestedPath) : resolve(resolvedRoot, requestedPath), resolvedRoot) ?? resolvedRoot;
+	try {
+		if (!(await stat(target)).isDirectory()) target = resolvedRoot;
+	} catch {
+		target = resolvedRoot;
+	}
+	const dirents = await readdir(target, { withFileTypes: true });
+	const entries = [];
+	for (const dirent of dirents) {
+		if (dirent.name.startsWith(".")) continue;
+		const entryPath = join(target, dirent.name);
+		let isDir = dirent.isDirectory();
+		if (dirent.isSymbolicLink()) {
+			const real = await realPathWithinRoot(entryPath, resolvedRoot);
+			isDir = real ? (await stat(real).catch(() => null))?.isDirectory() === true : false;
+		}
+		if (isDir) entries.push({
+			name: dirent.name,
+			path: entryPath
+		});
+	}
+	entries.sort((a, b) => a.name.localeCompare(b.name));
+	const parent = target === resolvedRoot ? null : resolve(target, "..");
+	return {
+		root: resolvedRoot,
+		path: target,
+		parent,
+		entries
+	};
+}
+async function listRenderedEntries(rootPath, currentPath = rootPath) {
+	const dirents = await readdir(currentPath, { withFileTypes: true });
+	const entries = [];
+	for (const dirent of dirents) {
+		const entryPath = join(currentPath, dirent.name);
+		const info = await lstat(entryPath);
+		const relativePath = entryPath.slice(rootPath.length + 1);
+		if (info.isDirectory()) {
+			entries.push({
+				name: dirent.name,
+				path: relativePath,
+				type: "directory",
+				size: info.size,
+				updatedAt: info.mtime.toISOString()
+			});
+			entries.push(...await listRenderedEntries(rootPath, entryPath));
+			continue;
+		}
+		if (info.isFile()) entries.push({
+			name: dirent.name,
+			path: relativePath,
+			type: "file",
+			size: info.size,
+			updatedAt: info.mtime.toISOString()
+		});
+	}
+	return entries.sort((a, b) => a.path.localeCompare(b.path));
+}
+async function listWorkspaceRenderedPath(root, workspacePath, renderedRoot) {
+	const safeRoot = assertApprovedRenderedRoot(renderedRoot);
+	const { workspace } = await confinedWorkspacePath(root, workspacePath);
+	const renderedPath = resolve(workspace, safeRoot);
+	if (!isWithinRoot(renderedPath, workspace)) throw new Error("Root escapes workspace");
+	const confinedRootPath = await realPathWithinRoot(renderedPath, workspace);
+	if (!confinedRootPath) return {
+		workspacePath: workspace,
+		root: safeRoot,
+		rootPath: renderedPath,
+		entries: []
+	};
+	if (!(await stat(confinedRootPath)).isDirectory()) return {
+		workspacePath: workspace,
+		root: safeRoot,
+		rootPath: confinedRootPath,
+		entries: []
+	};
+	return {
+		workspacePath: workspace,
+		root: safeRoot,
+		rootPath: confinedRootPath,
+		entries: await listRenderedEntries(confinedRootPath)
+	};
+}
+async function readWorkspaceFile(root, workspacePath, path) {
+	assertApprovedRenderedRoot(assertRelativePath(path, "path").split("/")[0] ?? "");
+	const { workspace, path: confinedPath, relativePath } = await confinedWorkspaceRelativePath(root, workspacePath, path);
+	const info = await lstat(confinedPath);
+	if (info.isDirectory()) throw new Error("Path is a directory");
+	if (!info.isFile()) throw new Error("Unsupported file type");
+	const bytesToRead = Math.min(info.size, MAX_TEXT_FILE_BYTES);
+	const contentBuffer = Buffer.alloc(bytesToRead);
+	const handle = await open(confinedPath, "r");
+	try {
+		await handle.read(contentBuffer, 0, bytesToRead, 0);
+	} finally {
+		await handle.close();
+	}
+	try {
+		const content = TEXT_DECODER.decode(contentBuffer);
+		return {
+			workspacePath: workspace,
+			path: relativePath,
+			name: relativePath.split("/").pop() ?? relativePath,
+			size: info.size,
+			updatedAt: info.mtime.toISOString(),
+			contentType: "text",
+			content,
+			truncated: info.size > MAX_TEXT_FILE_BYTES
+		};
+	} catch {
+		return {
+			workspacePath: workspace,
+			path: relativePath,
+			name: relativePath.split("/").pop() ?? relativePath,
+			size: info.size,
+			updatedAt: info.mtime.toISOString(),
+			contentType: "unsupported"
+		};
+	}
+}
+async function listArtifacts(root, workspacePath) {
+	const listing = await listWorkspaceRenderedPath(root, workspacePath, ".artifacts");
+	return {
+		rootPath: listing.workspacePath,
+		artifactsPath: listing.rootPath,
+		entries: listing.entries
+	};
+}
+/**
+* Resolve a `workspacePath` query param as a Factory session id. Returns the
+* session when one exists and the caller owns it, `null` when no session
+* matches (the caller should fall back to local-path handling), and throws
+* when a session exists but belongs to another tenant.
+*/
+async function resolveAuthorizedSession(c, deps, workspacePath) {
+	if (!deps) return null;
+	const session = await deps.sessions.getBySessionId(workspacePath);
+	if (!session) return null;
+	if (deps.auth.enabled()) {
+		await deps.auth.ensureUser(c);
+		const tenant = deps.auth.tenant(c);
+		if (!tenant || tenant.orgId !== session.orgId || tenant.userId !== session.userId) throw new Error("Session is not available to the current user");
+	}
+	return session;
+}
+/**
+* Reattach to the session's sandbox and wrap its workdir in a
+* `SandboxFilesystem`. Returns `null` when the session has no provisioned
+* sandbox yet (nothing materialized → nothing to list), or when the sandbox
+* can no longer be reattached (e.g. torn down by the provider's idle GC).
+* This is a passive read path, so it never re-provisions: the session's
+* filesystem is preserved in its provider checkpoint and comes back the next
+* time the workspace is actually opened (e.g. by sending a message).
+*/
+async function sessionSandbox(fleet, session) {
+	if (!fleet.enabled || !session.sandboxId || !session.sandboxWorkdir) return null;
+	let sandbox;
+	try {
+		sandbox = await fleet.reattachSandbox(session.sandboxId, { workingDirectory: session.sandboxWorkdir });
+	} catch {
+		return null;
+	}
+	return {
+		sandbox,
+		filesystem: new SandboxFilesystem({
+			sandbox,
+			workdir: session.sandboxWorkdir
+		}),
+		workdir: session.sandboxWorkdir
+	};
+}
+/** List an approved rendered root inside a Factory session's sandbox workdir. */
+async function listSessionRenderedPath(fleet, session, renderedRoot) {
+	const safeRoot = assertApprovedRenderedRoot(renderedRoot);
+	const rootPath = posix.join(session.sandboxWorkdir ?? "", safeRoot);
+	const empty = {
+		workspacePath: session.sessionId,
+		root: safeRoot,
+		rootPath,
+		entries: []
+	};
+	const handle = await sessionSandbox(fleet, session);
+	if (!handle) return empty;
+	const quotedRoot = `'${rootPath.replace(/'/g, `'\\''`)}'`;
+	const result = await handle.sandbox.executeCommand("sh", ["-c", `test -d ${quotedRoot} && find ${quotedRoot} -mindepth 1 -printf '%y\\t%s\\t%T@\\t%p\\n' 2>/dev/null || true`], { timeout: 3e4 });
+	if (result.exitCode !== 0) return empty;
+	const entries = [];
+	for (const line of result.stdout.split("\n")) {
+		if (!line) continue;
+		const [type, sizeStr, mtimeStr, ...pathParts] = line.split("	");
+		const fullPath = pathParts.join("	");
+		if (!fullPath || !fullPath.startsWith(`${rootPath}/`)) continue;
+		const relativePath = fullPath.slice(rootPath.length + 1);
+		entries.push({
+			name: posix.basename(relativePath),
+			path: relativePath,
+			type: type === "d" ? "directory" : "file",
+			size: type === "d" ? 0 : Number(sizeStr) || 0,
+			updatedAt: (/* @__PURE__ */ new Date((Number(mtimeStr) || 0) * 1e3)).toISOString()
+		});
+	}
+	entries.sort((a, b) => a.path.localeCompare(b.path));
+	return {
+		workspacePath: session.sessionId,
+		root: safeRoot,
+		rootPath,
+		entries
+	};
+}
+/** Read a file under an approved rendered root inside a session's sandbox. */
+async function readSessionWorkspaceFile(fleet, session, path) {
+	const safePath = assertRelativePath(path, "path");
+	assertApprovedRenderedRoot(safePath.split("/")[0] ?? "");
+	const handle = await sessionSandbox(fleet, session);
+	if (!handle) throw new Error("Session workspace is not available");
+	const { filesystem } = handle;
+	const info = await filesystem.stat(safePath);
+	if (info.type === "directory") throw new Error("Path is a directory");
+	const buffer = await filesystem.readFile(safePath);
+	const truncated = buffer.length > MAX_TEXT_FILE_BYTES;
+	const base = {
+		workspacePath: session.sessionId,
+		path: safePath,
+		name: posix.basename(safePath),
+		size: buffer.length,
+		updatedAt: info.modifiedAt.toISOString()
+	};
+	try {
+		const content = TEXT_DECODER.decode(truncated ? buffer.subarray(0, MAX_TEXT_FILE_BYTES) : buffer);
+		return {
+			...base,
+			contentType: "text",
+			content,
+			truncated
+		};
+	} catch {
+		return {
+			...base,
+			contentType: "unsupported"
+		};
+	}
+}
+function changeStatus(code) {
+	if (code === "??") return "untracked";
+	if (code.includes("U") || code === "AA" || code === "DD") return "conflicted";
+	if (code.includes("R")) return "renamed";
+	if (code.includes("C")) return "copied";
+	if (code.includes("D")) return "deleted";
+	if (code.includes("A")) return "added";
+	return "modified";
+}
+function parseWorkspaceChanges(output) {
+	const records = output.split("\0");
+	const changes = [];
+	for (let index = 0; index < records.length; index += 1) {
+		const record = records[index];
+		if (!record || record.length < 4) continue;
+		const code = record.slice(0, 2);
+		const path = record.slice(3);
+		const status = changeStatus(code);
+		if (status === "renamed" || status === "copied") {
+			const previousPath = records[index + 1];
+			if (previousPath) index += 1;
+			changes.push({
+				path,
+				previousPath: previousPath || void 0,
+				status
+			});
+			continue;
+		}
+		changes.push({
+			path,
+			status
+		});
+	}
+	return changes.toSorted((a, b) => a.path.localeCompare(b.path));
+}
+function parseWorkspaceChangeStats(output) {
+	const records = output.split("\0");
+	const stats = /* @__PURE__ */ new Map();
+	for (let index = 0; index < records.length; index += 1) {
+		const record = records[index];
+		if (!record) continue;
+		const firstTab = record.indexOf("	");
+		const secondTab = record.indexOf("	", firstTab + 1);
+		if (firstTab < 0 || secondTab < 0) continue;
+		const additionsText = record.slice(0, firstTab);
+		const deletionsText = record.slice(firstTab + 1, secondTab);
+		let path = record.slice(secondTab + 1);
+		if (!path) {
+			const renamedPath = records[index + 2];
+			if (!renamedPath) continue;
+			path = renamedPath;
+			index += 2;
+		}
+		if (path.startsWith("./")) path = path.slice(2);
+		if (additionsText === "-" || deletionsText === "-") {
+			stats.set(path, { binary: true });
+			continue;
+		}
+		const additions = Number(additionsText);
+		const deletions = Number(deletionsText);
+		if (Number.isFinite(additions) && Number.isFinite(deletions)) stats.set(path, {
+			additions,
+			deletions
+		});
+	}
+	return stats;
+}
+function unavailableWorkspaceChanges(workspacePath) {
+	return {
+		workspacePath,
+		available: false,
+		changes: []
+	};
+}
+async function listSessionWorkspaceChanges(fleet, session) {
+	const handle = await sessionSandbox(fleet, session);
+	if (!handle) return unavailableWorkspaceChanges(session.sessionId);
+	const [statusResult, statsResult] = await Promise.all([handle.sandbox.executeCommand("git", [
+		"-C",
+		handle.workdir,
+		"status",
+		"--porcelain=v1",
+		"-z",
+		"--untracked-files=all"
+	], { timeout: 3e4 }), handle.sandbox.executeCommand("sh", [
+		"-c",
+		WORKSPACE_NUMSTAT_SCRIPT,
+		"mastracode-numstat",
+		handle.workdir
+	], { timeout: 3e4 })]);
+	if (statusResult.exitCode !== 0) return unavailableWorkspaceChanges(session.sessionId);
+	const changes = parseWorkspaceChanges(statusResult.stdout);
+	if (statsResult.exitCode !== 0) return {
+		workspacePath: session.sessionId,
+		available: true,
+		changes
+	};
+	const stats = parseWorkspaceChangeStats(statsResult.stdout);
+	let additions = 0;
+	let deletions = 0;
+	const changesWithStats = changes.map((change) => {
+		const changeStats = stats.get(change.path);
+		additions += changeStats?.additions ?? 0;
+		deletions += changeStats?.deletions ?? 0;
+		return {
+			...change,
+			...changeStats
+		};
+	});
+	return {
+		workspacePath: session.sessionId,
+		available: true,
+		changes: changesWithStats,
+		additions,
+		deletions
+	};
+}
+async function executeBoundedGitDiff(sandbox, args, allowExitOne = false) {
+	return sandbox.executeCommand("sh", [
+		"-c",
+		BOUNDED_GIT_DIFF_SCRIPT,
+		"mastracode-diff",
+		allowExitOne ? "1" : "0",
+		...args
+	], { timeout: 3e4 });
+}
+function truncatePatch(patchBuffer) {
+	const patch = patchBuffer.subarray(0, MAX_DIFF_BYTES).toString("utf8");
+	const lastNewline = patch.lastIndexOf("\n");
+	if (lastNewline >= 0) return patch.slice(0, lastNewline + 1);
+	return patch.replace(/\uFFFD+$/, "");
+}
+async function readSessionWorkspaceDiff(fleet, session, path, previousPath) {
+	const safePath = assertRelativePath(path, "path");
+	const safePreviousPath = previousPath ? assertRelativePath(previousPath, "previousPath") : void 0;
+	const handle = await sessionSandbox(fleet, session);
+	if (!handle) throw new Error("Session workspace is not available");
+	const pathspecs = safePreviousPath ? [safePreviousPath, safePath] : [safePath];
+	let result = await executeBoundedGitDiff(handle.sandbox, [
+		"--literal-pathspecs",
+		"-C",
+		handle.workdir,
+		"diff",
+		"--find-renames",
+		"--no-ext-diff",
+		"--no-color",
+		"--unified=3",
+		"HEAD",
+		"--",
+		...pathspecs
+	]);
+	if (result.exitCode !== 0) throw new Error(result.stderr || "Unable to read workspace diff");
+	if (!result.stdout) {
+		const untracked = await handle.sandbox.executeCommand("git", [
+			"--literal-pathspecs",
+			"-C",
+			handle.workdir,
+			"ls-files",
+			"--others",
+			"--exclude-standard",
+			"--",
+			safePath
+		], { timeout: 3e4 });
+		if (untracked.exitCode === 0 && untracked.stdout.trim()) {
+			result = await executeBoundedGitDiff(handle.sandbox, [
+				"-C",
+				handle.workdir,
+				"diff",
+				"--no-index",
+				"--no-ext-diff",
+				"--no-color",
+				"--unified=3",
+				"--",
+				"/dev/null",
+				safePath
+			], true);
+			if (result.exitCode !== 0 && result.exitCode !== 1) throw new Error(result.stderr || "Unable to read workspace diff");
+		}
+	}
+	const patchBuffer = Buffer.from(result.stdout);
+	const truncated = patchBuffer.length > MAX_DIFF_BYTES;
+	return {
+		workspacePath: session.sessionId,
+		path: safePath,
+		patch: truncated ? truncatePatch(patchBuffer) : result.stdout,
+		truncated
+	};
+}
+/**
+* Resolve a project path to the same resourceId the TUI uses. Mirrors
+* `createMastraCode`: detect the project, then apply any resourceId override
+* (MASTRA_RESOURCE_ID env var or `.mastracode/database.json`). This is the
+* shared continuity point — start in the TUI, continue on the web, same path
+* → same resourceId → same session.
+*/
+function resolveCodebase(projectPath) {
+	const info = detectProject(projectPath);
+	return {
+		resourceId: getResourceIdOverride(info.rootPath) ?? info.resourceId,
+		name: info.name,
+		rootPath: info.rootPath,
+		gitUrl: info.gitUrl,
+		gitBranch: info.gitBranch
+	};
+}
+/**
+* Build the web filesystem routes as Mastra `apiRoutes`:
+*   - `GET /web/fs/list?path=...`        — browse directories (confined to root)
+*   - `GET /web/codebase/resolve?path=...` — TUI-compatible codebase resourceId
+*/
+function buildFsRoutes(options = {}) {
+	const root = resolveFsRoot(options.root);
+	const sessionFs = options.sessionFs;
+	return [
+		registerApiRoute("/web/fs/list", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const path = c.req.query("path");
+				try {
+					const listing = await listDirectory(root, path);
+					return c.json(listing);
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					return c.json({ error: message }, 500);
+				}
+			}
+		}),
+		registerApiRoute("/web/artifacts/list", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const path = c.req.query("path");
+				if (!path) return c.json({ error: "Missing required query param: path" }, 400);
+				try {
+					return c.json(await listArtifacts(root, path));
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					const status = message === "Path is outside the browsable root" ? 403 : 500;
+					return c.json({ error: message }, status);
+				}
+			}
+		}),
+		registerApiRoute("/web/workspace/rendered/list", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const workspacePath = c.req.query("workspacePath");
+				const renderedRoot = c.req.query("root");
+				if (!workspacePath) return c.json({ error: "Missing required query param: workspacePath" }, 400);
+				if (!renderedRoot) return c.json({ error: "Missing required query param: root" }, 400);
+				try {
+					const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);
+					if (session && sessionFs) return c.json(await listSessionRenderedPath(sessionFs.fleet, session, renderedRoot));
+					return c.json(await listWorkspaceRenderedPath(root, workspacePath, renderedRoot));
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					const status = message.includes("outside") || message.includes("relative") || message.includes("escapes") || message.includes("not approved") || message.includes("not available") ? 403 : 500;
+					return c.json({ error: message }, status);
+				}
+			}
+		}),
+		registerApiRoute("/web/workspace/changes", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const workspacePath = c.req.query("workspacePath");
+				if (!workspacePath) return c.json({ error: "Missing required query param: workspacePath" }, 400);
+				try {
+					const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);
+					if (!session || !sessionFs) return c.json(unavailableWorkspaceChanges(workspacePath));
+					return c.json(await listSessionWorkspaceChanges(sessionFs.fleet, session));
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					return c.json({ error: message }, message.includes("not available") ? 403 : 500);
+				}
+			}
+		}),
+		registerApiRoute("/web/workspace/changes/diff", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const workspacePath = c.req.query("workspacePath");
+				const path = c.req.query("path");
+				const previousPath = c.req.query("previousPath");
+				if (!workspacePath) return c.json({ error: "Missing required query param: workspacePath" }, 400);
+				if (!path) return c.json({ error: "Missing required query param: path" }, 400);
+				try {
+					const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);
+					if (!session || !sessionFs) return c.json({ error: "Session workspace is not available" }, 403);
+					return c.json(await readSessionWorkspaceDiff(sessionFs.fleet, session, path, previousPath));
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					const status = message.includes("relative") || message.includes("escapes") || message.includes("not available") ? 403 : 500;
+					return c.json({ error: message }, status);
+				}
+			}
+		}),
+		registerApiRoute("/web/workspace/file", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const workspacePath = c.req.query("workspacePath");
+				const path = c.req.query("path");
+				if (!workspacePath) return c.json({ error: "Missing required query param: workspacePath" }, 400);
+				if (!path) return c.json({ error: "Missing required query param: path" }, 400);
+				try {
+					const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);
+					if (session && sessionFs) return c.json(await readSessionWorkspaceFile(sessionFs.fleet, session, path));
+					return c.json(await readWorkspaceFile(root, workspacePath, path));
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					const status = message.includes("outside") || message.includes("relative") || message.includes("escapes") || message.includes("not approved") || message.includes("not available") ? 403 : message.includes("directory") ? 400 : message.includes("not found") ? 404 : 500;
+					return c.json({ error: message }, status);
+				}
+			}
+		}),
+		registerApiRoute("/web/codebase/resolve", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const path = c.req.query("path");
+				if (!path) return c.json({ error: "Missing required query param: path" }, 400);
+				const confined = await realPathWithinRoot(isAbsolute(path) ? resolve(path) : resolve(root, path), root);
+				if (!confined) return c.json({ error: "Path is outside the browsable root" }, 403);
+				try {
+					return c.json(resolveCodebase(confined));
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					return c.json({ error: message }, 500);
+				}
+			}
+		})
+	];
+}
+//#endregion
+export { buildFsRoutes, listArtifacts, listDirectory, listSessionRenderedPath, listSessionWorkspaceChanges, listWorkspaceRenderedPath, parseWorkspaceChangeStats, parseWorkspaceChanges, readSessionWorkspaceDiff, readSessionWorkspaceFile, readWorkspaceFile, resolveCodebase, resolveFsRoot };
+
+//# sourceMappingURL=fs.js.map