@maudecode/talaria-web 1.17.2 → 1.19.0

package/dist/api/raw-routes.js

@@ -3,38 +3,52 @@
  * ZIPs, transcript exports, and multipart uploads. Each mirrors its Python
  * handler and reuses the anchored file helpers.
  */
-import { closeSync, createReadStream, existsSync, readdirSync, statSync, realpathSync } from 'node:fs';
+import { closeSync, createReadStream, existsSync, mkdirSync, readdirSync, statSync, realpathSync } from 'node:fs';
 import { Readable } from 'node:stream';
 import { basename, join, relative } from 'node:path';
 import { HttpError } from './router.js';
-import { fileOpsSession } from './sessions-router.js';
+import { escapeRequest, fileError, fileOpsSession } from './sessions-router.js';
 import { HttpFailure } from '../sessions/service.js';
 import { SessionNotFound } from '../sessions/store.js';
-import { openAnchoredFd, safeResolve } from '../workspace/fs.js';
+import { FileExistsError, makeAnchoredDir, openAnchoredCreateFd, openAnchoredFd, rmtreeAnchored, safeResolve, safeResolveWs, unlinkAnchored } from '../workspace/fs.js';
 import { isWithin, resolvePathLikePython } from '../workspace/paths.js';
-import { AUDIO_VIDEO_PDF_TYPES, contentDispositionValue, INLINE_IMAGE_TYPES, isValidDigest, mediaAnchorRoot, mediaTarget, mimeFor, serveFileBytes, serveInlineHtmlPreview, snapshotPathForDigest, snapshotServableForPath } from '../workspace/media.js';
+import { isLoopback } from '../http/origin.js';
+import { truthy } from '../config.js';
+import { AUDIO_VIDEO_PDF_TYPES, contentDispositionValue, INLINE_IMAGE_TYPES, mediaAnchorRoot, mediaTarget, mimeFor, serveFileBytes, serveInlineHtmlPreview } from '../workspace/media.js';
 import { PREVIEW_PREFIX, previewGrantRoot } from '../workspace/preview.js';
 import { REMOTE_WORKSPACE_UNSUPPORTED_CODE, REMOTE_WORKSPACE_UNSUPPORTED_MESSAGE } from '../workspace/workspaces.js';
+import { WORKSPACE_BUSY_MESSAGE } from '../workspace/git.js';
 import { ZipWriter } from '../workspace/zip.js';
-import { parseMultipart, UploadConflict, UploadRejected } from '../workspace/upload.js';
-import { pythonPrettyJson, renderSessionHtml } from '../sessions/export.js';
+import { anchoredAt } from '../workspace/escape.js';
+import { guessMime, parseMultipart, sanitizeUploadName, uploadDestination, UploadConflict, UploadRejected } from '../workspace/upload.js';
+import { ArchiveRejected, CorruptArchive, extractArchive, isArchiveName } from '../workspace/extract.js';
+import { writeFully } from '../fs/atomic.js';
+import { pythonPrettyJson, renderSessionHtml, renderSessionMarkdown } from '../sessions/export.js';
 import { handleCspReport, handleTranscribe, handleTts } from './tools-raw.js';
 import { handleOidcCallback, handleOidcStart } from './auth-raw.js';
+import { handleTranscribeStream } from './transcribe-stream.js';
 const SANDBOX_CSP = 'sandbox allow-scripts allow-popups allow-popups-to-escape-sandbox';
 const DANGEROUS_TYPES = new Set(['text/html', 'application/xhtml+xml', 'image/svg+xml']);
 export const RAW_GET_ROUTES = {
     '/api/auth/oidc/start': handleOidcStart,
     '/api/auth/oidc/callback': handleOidcCallback,
     '/api/file/raw': handleFileRaw,
+    '/api/escape/file/raw': handleEscapeFileRaw,
     '/api/media': handleMedia,
     '/api/folder/download': handleFolderDownload,
     '/api/session/export': handleSessionExport,
+    '/api/transcribe/stream': handleTranscribeStream,
+    '/api/approval/inject_test': testHook(handleApprovalInject),
+    '/api/clarify/inject_test': testHook(handleClarifyInject),
 };
 export const RAW_POST_ROUTES = {
     '/api/upload': handleUpload,
+    '/api/upload/extract': handleUploadExtract,
+    '/api/workspace/upload': handleWorkspaceUpload,
     '/api/transcribe': handleTranscribe,
     '/api/tts': handleTts,
     '/api/csp-report': handleCspReport,
+    '/api/process-complete-ack': handleProcessCompleteAck,
 };
 /** Run a raw handler, translating thrown `HttpError`s into the JSON error body. */
 export async function runRaw(ctx, handler) {
@@ -45,20 +59,54 @@ export async function runRaw(ctx, handler) {
         if (ctx.isFinished)
             return;
         if (error instanceof HttpError) {
-            ctx.json({ error: error.message, ...error.data }, { status: error.status });
+            await ctx.json({ error: error.message, ...error.data }, { status: error.status });
             return;
         }
         if (error instanceof HttpFailure) {
-            ctx.json({ error: error.message, ...error.extra }, { status: error.status });
+            await ctx.json({ error: error.message, ...error.extra }, { status: error.status });
             return;
         }
         if (error instanceof SessionNotFound) {
-            ctx.json({ error: 'Session not found' }, { status: 404 });
+            await ctx.json({ error: 'Session not found' }, { status: 404 });
             return;
         }
         throw error;
     }
 }
+/** Retired by the `process_complete` -> `bg_task_complete` rename: always 410, naming the replacement. */
+async function handleProcessCompleteAck(ctx) {
+    await ctx.json({ error: 'gone: /api/process-complete-ack was replaced by /api/bg-task-complete-ack as part of the process_complete -> bg_task_complete event rename', replaced_by: '/api/bg-task-complete-ack' }, { status: 410, headers: { 'X-Replaced-By': '/api/bg-task-complete-ack' } });
+}
+/**
+ * Automated-test hooks: served only to a loopback peer while `HERMES_WEBUI_TEST_HOOKS=1` is set (loopback alone means
+ * nothing behind a same-host reverse proxy); anything else gets the plain 404.
+ */
+function testHook(handler) {
+    return async (ctx) => {
+        if (!truthy(ctx.deps.config.env.HERMES_WEBUI_TEST_HOOKS) || !isLoopback(ctx.peer)) {
+            await ctx.json({ error: 'not found' }, { status: 404 });
+            return;
+        }
+        return handler(ctx);
+    };
+}
+/** Queue a fake approval; `_injected` entries are answered locally, since no Agent is parked on them. */
+async function handleApprovalInject(ctx) {
+    const sid = ctx.query.get('session_id') ?? '';
+    if (!sid)
+        throw new HttpError(400, 'session_id required');
+    const key = ctx.query.get('pattern_key') || 'test_pattern';
+    ctx.deps.pending.submitApproval(sid, { command: ctx.query.get('command') || 'rm -rf /tmp/test', pattern_key: key, pattern_keys: [key], description: 'test pattern', session_id: sid, _injected: true });
+    await ctx.json({ ok: true, session_id: sid });
+}
+/** Queue a fake clarify prompt (repeated `choices`); answered locally like an injected approval. */
+async function handleClarifyInject(ctx) {
+    const sid = ctx.query.get('session_id') ?? '';
+    if (!sid)
+        throw new HttpError(400, 'session_id required');
+    ctx.deps.pending.submitClarify(sid, { question: ctx.query.get('question') || 'Which option?', choices_offered: ctx.query.getAll('choices').filter(Boolean), session_id: sid, kind: 'clarify', _injected: true });
+    await ctx.json({ ok: true, session_id: sid });
+}
 function fileRawTarget(ctx, workspace, sid, rel) {
     try {
         const target = safeResolve(workspace, rel);
@@ -75,38 +123,54 @@ function fileRawTarget(ctx, workspace, sid, rel) {
     catch { /* none */ }
     return null;
 }
-function handleFileRaw(ctx) {
+async function handleFileRaw(ctx) {
     const sid = ctx.query.get('session_id') ?? '';
     if (!sid)
         throw new HttpError(400, 'session_id is required');
-    const s = fileOpsSession(ctx, sid);
+    const s = (await fileOpsSession(ctx, sid));
     const rel = ctx.query.get('path') ?? '';
     if (rel.includes('\0'))
         throw new HttpError(400, 'invalid path');
-    const forceDownload = ctx.query.get('download') === '1';
     const resolved = fileRawTarget(ctx, s.workspace, sid, rel);
     if (!resolved) {
-        ctx.json({ error: 'not found' }, { status: 404 });
+        await ctx.json({ error: 'not found' }, { status: 404 });
         return;
     }
-    const [anchorRoot, target] = resolved;
+    await serveRawFile(ctx, resolved[0], resolved[1]);
+}
+/** Python `_handle_escape_file_raw`: `/api/file/raw` for a path under an escape grant, anchored at the grant root. */
+async function handleEscapeFileRaw(ctx) {
+    const req = (await escapeRequest(ctx, ctx.query.get('session_id') ?? '', ctx.query.get('token') ?? '', ctx.query.get('path') ?? ''));
+    let target;
+    try {
+        target = ctx.deps.escapeGrants.rawTarget(req);
+    }
+    catch (error) {
+        throw fileError(error, 404);
+    }
+    // The anchored open and fstat in `serveRawFile` answer a missing or non-file target with 404 through the pinned root.
+    await anchoredAt(req, async () => { (await serveRawFile(ctx, req.externalRoot, target)); });
+}
+/** The `/api/file/raw` response: MIME, attachment for dangerous types unless an inline HTML preview, sandbox CSP, no-store. */
+async function serveRawFile(ctx, anchorRoot, target) {
+    const forceDownload = ctx.query.get('download') === '1';
     const mime = mimeFor(target);
     const inlinePreview = ctx.query.get('inline') === '1';
     const htmlInlineOk = inlinePreview && mime === 'text/html';
     const disposition = forceDownload || (DANGEROUS_TYPES.has(mime) && !htmlInlineOk) ? 'attachment' : 'inline';
     const csp = inlinePreview && !forceDownload && disposition === 'inline' ? SANDBOX_CSP : null;
     if (htmlInlineOk) {
-        serveInlineHtmlPreview(ctx, target, 'no-store', SANDBOX_CSP, anchorRoot);
+        await serveInlineHtmlPreview(ctx, target, 'no-store', SANDBOX_CSP, anchorRoot);
         return;
     }
-    serveFileBytes(ctx, target, { mime, disposition, cacheControl: 'no-store', csp, anchorRoot });
+    await serveFileBytes(ctx, target, { mime, disposition, cacheControl: 'no-store', csp, anchorRoot });
 }
 /**
  * `/workspace-preview/<grant>/<path>` (TAL-566): the HTML preview frame and its relative assets, authorized by the
  * signed grant rather than a cookie. Every response carries the sandbox CSP and no CORS header, so the page's scripts
  * can run and load assets but cannot read workspace files.
  */
-export function handleWorkspacePreview(ctx) {
+export async function handleWorkspacePreview(ctx) {
     const rest = ctx.path.slice(PREVIEW_PREFIX.length);
     const slash = rest.indexOf('/');
     const root = slash > 0 ? previewGrantRoot(ctx.deps.auth.signingKey(), rest.slice(0, slash)) : null;
@@ -121,16 +185,16 @@ export function handleWorkspacePreview(ctx) {
         catch { /* malformed escape or outside the root */ }
     }
     if (!root || !target) {
-        ctx.json({ error: 'not found' }, { status: 404 });
+        await ctx.json({ error: 'not found' }, { status: 404 });
         return;
     }
     const mime = mimeFor(target);
     if (mime === 'text/html')
-        serveInlineHtmlPreview(ctx, target, 'no-store', SANDBOX_CSP, root);
+        (await serveInlineHtmlPreview(ctx, target, 'no-store', SANDBOX_CSP, root));
     else
-        serveFileBytes(ctx, target, { mime, disposition: 'inline', cacheControl: 'no-store', csp: SANDBOX_CSP, anchorRoot: root });
+        (await serveFileBytes(ctx, target, { mime, disposition: 'inline', cacheControl: 'no-store', csp: SANDBOX_CSP, anchorRoot: root }));
 }
-function handleMedia(ctx) {
+async function handleMedia(ctx) {
     const { deps } = ctx;
     const rawPath = (ctx.query.get('path') ?? '').trim();
     if (!rawPath)
@@ -140,7 +204,7 @@ function handleMedia(ctx) {
     let localAllowed;
     if (sessionId) {
         try {
-            mediaSession = deps.sessionStore.get(sessionId);
+            mediaSession = (await deps.sessionStore.get(sessionId));
         }
         catch {
             throw new HttpError(404, 'Session not found');
@@ -150,7 +214,7 @@ function handleMedia(ctx) {
     else
         localAllowed = deps.workspaces.profileSupportsLocalIo(null);
     if (!localAllowed) {
-        ctx.json({ error: REMOTE_WORKSPACE_UNSUPPORTED_CODE, message: REMOTE_WORKSPACE_UNSUPPORTED_MESSAGE }, { status: 400 });
+        await ctx.json({ error: REMOTE_WORKSPACE_UNSUPPORTED_CODE, message: REMOTE_WORKSPACE_UNSUPPORTED_MESSAGE }, { status: 400 });
         return;
     }
     let target;
@@ -160,7 +224,7 @@ function handleMedia(ctx) {
     catch {
         throw new HttpError(400, 'Invalid path');
     }
-    const anchorRoot = mediaAnchorRoot(target, mediaSession, deps.mediaAccess);
+    const anchorRoot = (await mediaAnchorRoot(target, mediaSession, deps.mediaAccess));
     if (!anchorRoot)
         throw new HttpError(403, 'Path not in allowed location');
     const mime = mimeFor(target);
@@ -169,24 +233,8 @@ function handleMedia(ctx) {
     const inlinePreviewTypes = new Set([...INLINE_IMAGE_TYPES, ...AUDIO_VIDEO_PDF_TYPES]);
     const disposition = mime !== 'image/svg+xml' && (INLINE_IMAGE_TYPES.has(mime) || (inlinePreview && inlinePreviewTypes.has(mime)) || htmlInlineOk) ? 'inline' : 'attachment';
     const csp = htmlInlineOk ? 'sandbox allow-scripts' : null;
-    const snapDigest = (ctx.query.get('snap') ?? '').trim().toLowerCase();
-    if (snapDigest) {
-        const snapDir = resolvePathLikePython(deps.mediaPolicy.snapshotDir());
-        if (isValidDigest(snapDigest)) {
-            let snapshotFile = snapshotPathForDigest(snapDir, snapDigest);
-            if (snapshotFile && !snapshotServableForPath(snapDir, snapDigest, target))
-                snapshotFile = null;
-            if (!snapshotFile) {
-                ctx.json({ error: 'snapshot unavailable' }, { status: 410 });
-                return;
-            }
-            // Same inode rule as live media: a `.snap` replaced by a hard link to a state file must not be served as the snapshot.
-            serveFileBytes(ctx, snapshotFile, { mime, disposition, cacheControl: 'private, max-age=31536000, immutable', csp, downloadName: basename(target), anchorRoot: snapDir, denyHardLinks: true });
-            return;
-        }
-    }
     // The pathname policy ran before the open; the hard-link rule is re-applied to the inode actually opened.
-    serveFileBytes(ctx, target, { mime, disposition, cacheControl: mime === 'text/html' ? 'no-store' : 'private, no-cache', csp, anchorRoot, denyHardLinks: true });
+    await serveFileBytes(ctx, target, { mime, disposition, cacheControl: mime === 'text/html' ? 'no-store' : 'private, no-cache', csp, anchorRoot, denyHardLinks: true });
 }
 /** Python `_folder_zip_limits`: `HERMES_WEBUI_FOLDER_ZIP_MAX_MB` / `_MAX_FILES` are honoured as given (ZIP64 covers large archives). */
 export function folderZipMaxBytes(env) {
@@ -265,7 +313,7 @@ async function handleFolderDownload(ctx) {
     const sid = ctx.query.get('session_id') ?? '';
     if (!sid)
         throw new HttpError(400, 'session_id is required');
-    const s = fileOpsSession(ctx, sid);
+    const s = (await fileOpsSession(ctx, sid));
     const rel = ctx.query.get('path') ?? '';
     let target;
     try {
@@ -275,7 +323,7 @@ async function handleFolderDownload(ctx) {
         throw new HttpError(400, 'invalid path');
     }
     if (!existsSync(target)) {
-        ctx.json({ error: 'not found' }, { status: 404 });
+        await ctx.json({ error: 'not found' }, { status: 404 });
         return;
     }
     if (!statSync(target).isDirectory())
@@ -285,11 +333,11 @@ async function handleFolderDownload(ctx) {
     const maxFiles = folderZipMaxFiles(ctx.deps.config.env);
     const { files, limit } = collectFolder(target, workspaceRoot, maxBytes, maxFiles);
     if (limit === 'max_files') {
-        ctx.json({ error: 'too many files', limit: maxFiles, configure: 'HERMES_WEBUI_FOLDER_ZIP_MAX_FILES' }, { status: 413 });
+        await ctx.json({ error: 'too many files', limit: maxFiles, configure: 'HERMES_WEBUI_FOLDER_ZIP_MAX_FILES' }, { status: 413 });
         return;
     }
     if (limit === 'max_bytes') {
-        ctx.json({ error: 'folder too large', limit_bytes: maxBytes, configure: 'HERMES_WEBUI_FOLDER_ZIP_MAX_MB' }, { status: 413 });
+        await ctx.json({ error: 'folder too large', limit_bytes: maxBytes, configure: 'HERMES_WEBUI_FOLDER_ZIP_MAX_MB' }, { status: 413 });
         return;
     }
     const zipName = `${basename(target) || 'workspace'}.zip`;
@@ -329,13 +377,13 @@ async function handleFolderDownload(ctx) {
         ctx.res.end();
     }
 }
-function handleSessionExport(ctx) {
+async function handleSessionExport(ctx) {
     const sid = ctx.query.get('session_id') ?? '';
     if (!sid)
         throw new HttpError(400, 'session_id is required');
     let session;
     try {
-        session = ctx.deps.sessionStore.get(sid);
+        session = (await ctx.deps.sessionStore.get(sid));
     }
     catch {
         throw new HttpError(404, 'Session not found');
@@ -366,20 +414,26 @@ function handleSessionExport(ctx) {
         contentType = 'text/html; charset=utf-8';
         ext = 'html';
     }
+    else if (fmt === 'markdown') {
+        payload = renderSessionMarkdown(safe);
+        contentType = 'text/markdown; charset=utf-8';
+        ext = 'md';
+    }
     else {
         payload = pythonPrettyJson(safe);
         contentType = 'application/json; charset=utf-8';
         ext = 'json';
     }
-    ctx.send({ status: 200, headers: { 'Content-Type': contentType, 'Content-Disposition': `attachment; filename="hermes-${sid}.${ext}"`, 'Cache-Control': 'no-store' }, body: Buffer.from(payload, 'utf8') });
+    await ctx.send({ status: 200, headers: { 'Content-Type': contentType, 'Content-Disposition': `attachment; filename="hermes-${sid}.${ext}"`, 'Cache-Control': 'no-store' }, body: Buffer.from(payload, 'utf8') });
 }
-async function handleUpload(ctx) {
+/** The shared upload preamble: the declared-size gate, the bounded body read, and the multipart parse (answers on failure). */
+export async function readUploadForm(ctx) {
     const maxBytes = ctx.deps.config.maxUploadBytes;
     const contentType = ctx.header('content-type') ?? '';
     const contentLength = Number.parseInt(ctx.header('content-length') ?? '0', 10) || 0;
     if (contentLength > maxBytes) {
-        ctx.json({ error: `File too large (max ${String(Math.floor(maxBytes / 1024 / 1024))}MB)` }, { status: 413 });
-        return;
+        await ctx.json({ error: `File too large (max ${String(Math.floor(maxBytes / 1024 / 1024))}MB)` }, { status: 413 });
+        return null;
     }
     let raw;
     try {
@@ -387,57 +441,216 @@ async function handleUpload(ctx) {
     }
     catch {
         // Node's parser already answers a garbage or negative Content-Length with 400 before this handler runs.
-        ctx.json({ error: `Upload too large (max ${String(maxBytes)} bytes)` }, { status: 400 });
-        return;
+        await ctx.json({ error: `Upload too large (max ${String(maxBytes)} bytes)` }, { status: 400 });
+        return null;
     }
-    let parsed;
     try {
-        parsed = parseMultipart(raw, contentType);
+        return parseMultipart(raw, contentType);
     }
     catch (error) {
-        ctx.json({ error: error.message }, { status: 400 });
-        return;
+        await ctx.json({ error: error.message }, { status: 400 });
+        return null;
     }
-    const sessionId = parsed.fields.session_id ?? ctx.query.get('session_id') ?? '';
-    const file = parsed.files.file;
+}
+/** The single `file` part of a chat upload, or null after answering 400. */
+export async function uploadFile(ctx, form) {
+    const file = form.files.file;
     if (!file) {
-        ctx.json({ error: 'No file field in request' }, { status: 400 });
-        return;
+        await ctx.json({ error: 'No file field in request' }, { status: 400 });
+        return null;
     }
     if (!file.filename) {
-        ctx.json({ error: 'No filename in upload' }, { status: 400 });
-        return;
+        await ctx.json({ error: 'No filename in upload' }, { status: 400 });
+        return null;
     }
+    return file;
+}
+/** An unknown session and another profile's session both answer 404 before anything is written. */
+async function uploadSessionVisible(ctx, sessionId) {
     let session;
     try {
-        session = ctx.deps.sessionStore.get(sessionId, { metadataOnly: true });
+        session = (await ctx.deps.sessionStore.get(sessionId, { metadataOnly: true }));
     }
     catch {
-        ctx.json({ error: 'Session not found' }, { status: 404 });
-        return;
+        await ctx.json({ error: 'Session not found' }, { status: 404 });
+        return false;
     }
     if (!ctx.deps.profilesMatch(session.profile, ctx.deps.activeProfile())) {
-        ctx.json({ error: 'Session not found' }, { status: 404 });
-        return;
+        await ctx.json({ error: 'Session not found' }, { status: 404 });
+        return false;
     }
+    return true;
+}
+async function handleUpload(ctx) {
+    const form = await readUploadForm(ctx);
+    if (!form)
+        return;
+    const sessionId = form.fields.session_id ?? ctx.query.get('session_id') ?? '';
+    const file = (await uploadFile(ctx, form));
+    if (!file || !(await uploadSessionVisible(ctx, sessionId)))
+        return;
     try {
-        ctx.json(ctx.deps.uploads.store(sessionId, file.filename, file.body));
+        await ctx.json(ctx.deps.uploads.store(sessionId, file.filename, file.body));
     }
     catch (error) {
         if (error instanceof UploadConflict) {
-            ctx.json({ error: error.message }, { status: 409 });
+            (await ctx.json({ error: error.message }, { status: 409 }));
             return;
         }
         if (error instanceof UploadRejected) {
-            ctx.json({ error: error.message }, { status: 403 });
+            (await ctx.json({ error: error.message }, { status: 403 }));
             return;
         }
         if (error instanceof Error && error.message === 'Invalid filename') {
-            ctx.json({ error: error.message }, { status: 400 });
+            (await ctx.json({ error: error.message }, { status: 400 }));
             return;
         }
         ctx.deps.log(`[webui] upload error: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
-        ctx.json({ error: 'Upload failed' }, { status: 500 });
+        await ctx.json({ error: 'Upload failed' }, { status: 500 });
     }
 }
+/** Python `handle_upload_extract`: unpack an archive into `<session inbox>/<stem>` with a directory rollback receipt. */
+async function handleUploadExtract(ctx) {
+    const form = await readUploadForm(ctx);
+    if (!form)
+        return;
+    const sessionId = form.fields.session_id ?? '';
+    const file = (await uploadFile(ctx, form));
+    if (!file || !(await uploadSessionVisible(ctx, sessionId)))
+        return;
+    const { uploads } = ctx.deps;
+    try {
+        const inbox = uploads.sessionDir(sessionId);
+        mkdirSync(inbox, { recursive: true });
+        const result = await extractArchive(file.body, file.filename, inbox, inbox, ctx.deps.config.maxExtractedBytes);
+        let token;
+        try {
+            token = uploads.registerReceipt(sessionId, result.dest, true);
+        }
+        catch (error) {
+            try {
+                rmtreeAnchored(inbox, result.dest);
+            }
+            catch { /* ignore */ }
+            throw error;
+        }
+        await ctx.json({ ok: true, ...result, rollback_token: token });
+    }
+    catch (error) {
+        if (error instanceof ArchiveRejected) {
+            (await ctx.json({ error: error.message }, { status: 400 }));
+            return;
+        }
+        ctx.deps.log(`[webui] upload extract error: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+        await ctx.json({ error: 'Archive extraction failed' }, { status: 500 });
+    }
+}
+/**
+ * Python `handle_workspace_upload`: store each multipart file under `<workspace>/<path>` (deduplicated `-1`...`-999`);
+ * an archive is extracted into `<path>/<stem>` and removed, and a failed extraction is reported on that file.
+ */
+async function handleWorkspaceUpload(ctx) {
+    const form = await readUploadForm(ctx);
+    if (!form)
+        return;
+    const sessionId = form.fields.session_id ?? '';
+    const subpath = form.fields.path ?? '';
+    if (!sessionId)
+        throw new HttpError(400, 'Missing session_id');
+    if (!form.parts.length)
+        throw new HttpError(400, 'No file field in request');
+    let workspace;
+    try {
+        workspace = (await fileOpsSession(ctx, sessionId, { strictWorkspace: true })).workspace;
+    }
+    catch (error) {
+        if (error instanceof HttpError && error.message === REMOTE_WORKSPACE_UNSUPPORTED_CODE)
+            throw new HttpError(400, REMOTE_WORKSPACE_UNSUPPORTED_MESSAGE, { code: REMOTE_WORKSPACE_UNSUPPORTED_CODE });
+        throw error;
+    }
+    workspace = resolvePathLikePython(workspace);
+    if (ctx.deps.git.workspaceBusy(workspace))
+        throw new HttpError(409, WORKSPACE_BUSY_MESSAGE);
+    let targetDir;
+    try {
+        targetDir = subpath ? safeResolveWs(workspace, subpath) : workspace;
+    }
+    catch (error) {
+        throw new HttpError(400, error.message);
+    }
+    try {
+        makeAnchoredDir(workspace, targetDir);
+    }
+    catch {
+        throw new HttpError(403, 'Upload target escapes workspace');
+    }
+    const results = [];
+    try {
+        // Held for the whole upload, extraction included, so a Git operation cannot start in this workspace meanwhile.
+        await ctx.deps.git.holdWrite(workspace, async () => {
+            for (const file of form.parts) {
+                if (!file.filename)
+                    continue;
+                const safeName = sanitizeUploadName(file.filename);
+                let dest;
+                try {
+                    dest = uploadDestination(targetDir, safeName);
+                }
+                catch (error) {
+                    if (error instanceof UploadRejected)
+                        throw new HttpError(400, error.message);
+                    throw error;
+                }
+                let fd;
+                try {
+                    fd = openAnchoredCreateFd(workspace, dest);
+                }
+                catch (error) {
+                    if (error instanceof FileExistsError)
+                        throw new HttpError(409, `Upload destination already exists: ${safeName}`);
+                    throw new HttpError(403, `Path traversal blocked: ${safeName}`);
+                }
+                try {
+                    writeFully(fd, file.body);
+                }
+                finally {
+                    closeSync(fd);
+                }
+                const mime = guessMime(safeName);
+                if (isArchiveName(safeName)) {
+                    let outcome;
+                    try {
+                        const extraction = await extractArchive(file.body, safeName, workspace, targetDir, ctx.deps.config.maxExtractedBytes);
+                        outcome = { filename: safeName, path: extraction.dest, size: file.body.length, is_image: false, extracted: true, extracted_files: extraction.files, extracted_count: extraction.extracted };
+                    }
+                    catch (error) {
+                        const reason = error instanceof ArchiveRejected || error instanceof CorruptArchive ? error.message : null;
+                        ctx.deps.log(`[webui] workspace upload extract error: ${reason ?? (error instanceof Error ? (error.stack ?? error.message) : String(error))}`);
+                        outcome = { filename: safeName, path: targetDir, size: file.body.length, mime, is_image: false, extracted: false, extract_error: reason || 'Archive extraction failed' };
+                    }
+                    // The archive itself never stays behind, whether or not it extracted.
+                    try {
+                        unlinkAnchored(workspace, dest);
+                    }
+                    catch (error) {
+                        if (error.code !== 'ENOENT')
+                            throw error;
+                    }
+                    results.push(outcome);
+                    continue;
+                }
+                results.push({ filename: basename(dest), path: dest, size: file.body.length, mime, is_image: mime.startsWith('image/'), extracted: false });
+            }
+        });
+    }
+    catch (error) {
+        if (error instanceof HttpError)
+            throw error;
+        if (error instanceof Error && error.message === 'Invalid filename')
+            throw new HttpError(400, error.message);
+        ctx.deps.log(`[webui] workspace upload error: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+        throw new HttpError(500, 'Upload failed');
+    }
+    await ctx.json(results.length === 1 ? results[0] : { files: results, count: results.length });
+}
 //# sourceMappingURL=raw-routes.js.map