@mrpatronz/nexusflow 2.4.0 → 2.5.0

package/dist/server.js

@@ -17,19 +17,22 @@ import * as os from 'node:os';
 import { pipeline } from 'node:stream/promises';
 import { spawn } from 'node:child_process';
 import { loadConfig, saveConfig, getConfigDir } from './core/config.js';
+import { configPatchSchema } from './core/config-schema.js';
 import { listStorageProviders } from './core/adapters/registry.js';
 import { scanForRepos } from './core/scanner.js';
-import { createNewRepo } from './core/new-repo.js';
+import { createNewRepo, isValidProjectName } from './core/new-repo.js';
 import { loadProjects, createProject, updateProject, removeProject, slugifyProjectName } from './core/projects.js';
 import { getSessionCwd, isInPlace, resolveFeatureRepoPath } from './utils/feature.js';
 import { listBranches } from './utils/git.js';
-import { createWorkspace, listWorkspaces, loadFeatureConfig, loadWorkspaceManifest, deleteWorkspace, addRepoToWorkspace } from './core/workspace.js';
+import { createWorkspace, listWorkspaces, loadFeatureConfig, loadWorkspaceManifest, deleteWorkspace, addRepoToWorkspace, isolateWorkspaceRepo } from './core/workspace.js';
 import { loadWorkspaceState } from './core/workspace-state.js';
 import { analyzeAllRepos } from './analyzers/index.js';
 import { generateContextFiles } from './generators/index.js';
 import { detectAIAssistants } from './utils/detect-ai.js';
 import { detectEditors } from './utils/detect-editors.js';
 import { buildWorkspaceLaunchPrompt, detectWorkspaceLaunchTargets, launchTargetIdForEditorCommand, launchWorkspaceTarget, } from './utils/workspace-launch.js';
+import { isBinaryOnPath, launchWorkspaceTerminal, SUPPORTED_ASSISTANTS } from './utils/terminal-launch.js';
+import { openInEditor } from './utils/open-editor.js';
 import { canOpenCodexSessionInWorkspace, canTransferClaudeSessionInWorkspace, findSessions, getSessionTranscript, } from './utils/session-finder.js';
 import { ProviderRegistry } from './agent/adapters.js';
 import { isValidSessionUuid } from './agent/session.js';
@@ -291,7 +294,15 @@ const DESKTOP_HANDOFF_SCAN_LIMIT = 20;
  * Claude's documented `/desktop` transfer is narrower than its URI handler:
  * it requires macOS or x64 Windows, a subscription login, and a usable CLI.
  */
-export function canOfferClaudeDesktopTransfer(platform = process.platform, architecture = process.arch, env = process.env, isCliConfigured = () => ProviderRegistry.getProvider('claude-cli')?.isConfigured() === true) {
+export function canOfferClaudeDesktopTransfer(platform = process.platform, architecture = process.arch, env = process.env, isCliConfigured = () => {
+    try {
+        const provider = ProviderRegistry.getProvider('claude-cli');
+        if (provider?.isConfigured())
+            return true;
+    }
+    catch { }
+    return isBinaryOnPath('claude');
+}) {
     const supportedPlatform = platform === 'darwin' || (platform === 'win32' && architecture === 'x64');
     const usesUnsupportedAuth = Boolean(env.ANTHROPIC_API_KEY
         || env.ANTHROPIC_AUTH_TOKEN
@@ -425,6 +436,33 @@ app.use('/api/*', cors({
         }
     },
 }));
+// --- host guard: DNS rebinding protection ---
+function isAllowedHost(hostHeader) {
+    if (!hostHeader)
+        return true; // Internal Hono programmatic invocations / test requests
+    const hostname = hostHeader.startsWith('[')
+        ? hostHeader.slice(1, hostHeader.indexOf(']'))
+        : hostHeader.split(':')[0]?.toLowerCase() ?? '';
+    return ['localhost', '127.0.0.1', '::1'].includes(hostname);
+}
+app.use('*', async (c, next) => {
+    const host = c.req.header('host');
+    if (!isAllowedHost(host)) {
+        return c.text('Forbidden: invalid Host header', 403);
+    }
+    await next();
+});
+// Enforce trusted local origin on all mutating HTTP methods across /api/* to defend against
+// cross-site request forgery and browser form posts from untrusted web pages.
+app.use('/api/*', async (c, next) => {
+    if (['POST', 'PUT', 'DELETE', 'PATCH'].includes(c.req.method)) {
+        const origin = c.req.header('origin');
+        if (origin && !hasTrustedLocalOrigin(origin)) {
+            return c.json({ error: 'Forbidden cross-origin request.' }, 403);
+        }
+    }
+    await next();
+});
 // ─── API Endpoints ────────────────────────────────────────────────────────
 // Status checks may execute a trusted local CLI from PATH. Keep that work
 // behind a non-simple, same-machine POST so a remote page cannot trigger it
@@ -479,9 +517,15 @@ app.get('/api/adapters', async (c) => {
 // 2. Save configuration
 app.post('/api/config', async (c) => {
     try {
-        const newConfig = await c.req.json();
-        await saveConfig(newConfig);
-        return c.json({ success: true, config: newConfig });
+        const body = await c.req.json().catch(() => null);
+        const parsed = configPatchSchema.safeParse(body);
+        if (!parsed.success) {
+            return c.json({ error: 'Invalid config payload', issues: parsed.error.flatten() }, 400);
+        }
+        const current = await loadConfig();
+        const next = { ...current, ...parsed.data };
+        await saveConfig(next);
+        return c.json({ success: true, config: next });
     }
     catch (error) {
         return errorResponse(c, error);
@@ -596,11 +640,16 @@ app.delete('/api/projects/:id', async (c) => {
         return errorResponse(c, error);
     }
 });
-// 4. List existing workspaces
+// 4. List existing workspaces (ordered by newest creation date first)
 app.get('/api/workspaces', async (c) => {
     try {
         const config = await loadConfig();
         const workspaces = await listWorkspaces(config.workspacesDir);
+        workspaces.sort((a, b) => {
+            const aTime = new Date(a.createdAt || 0).getTime();
+            const bTime = new Date(b.createdAt || 0).getTime();
+            return bTime - aTime;
+        });
         return c.json(workspaces);
     }
     catch (error) {
@@ -857,6 +906,19 @@ app.post('/api/workspace', async (c) => {
             return c.json({ error: 'Missing "branchName" in request body' }, 400);
         }
         const config = await loadConfig();
+        // Validate repo names and paths synchronously before starting the job.
+        for (const r of body.repos || []) {
+            if (inPlace) {
+                if (config.devDir && r.path) {
+                    assertWithin(config.devDir, path.resolve(r.path));
+                }
+            }
+            else {
+                if (r.name && !isValidProjectName(r.name)) {
+                    return c.json({ error: `Invalid repository name: ${JSON.stringify(r.name)}` }, 400);
+                }
+            }
+        }
         // The job id doubles as the workspace directory name.
         const jobId = inPlace ? slugifyProjectName(body.name) : body.branchName;
         if (!jobId) {
@@ -984,6 +1046,9 @@ app.post('/api/workspace/:id/repo', async (c) => {
         const id = decodeURIComponent(c.req.param('id'));
         const { repoPath } = await c.req.json();
         const config = await loadConfig();
+        if (config.devDir) {
+            assertWithin(config.devDir, path.resolve(repoPath));
+        }
         const workspacePath = resolveWorkspacePath(config.workspacesDir, id);
         await addRepoToWorkspace(workspacePath, repoPath);
         return c.json({ success: true });
@@ -992,6 +1057,29 @@ app.post('/api/workspace/:id/repo', async (c) => {
         return errorResponse(c, error);
     }
 });
+// 7.7b. Isolate repo in in-place workspace
+app.post('/api/workspace/:id/isolate', async (c) => {
+    try {
+        const id = decodeURIComponent(c.req.param('id'));
+        const body = await c.req.json().catch(() => ({}));
+        const repo = typeof body.repo === 'string' ? body.repo.trim() : '';
+        if (!repo) {
+            return c.json({ error: 'Missing "repo" parameter in request body' }, 400);
+        }
+        const branchName = typeof body.branchName === 'string' && body.branchName.trim() ? body.branchName.trim() : undefined;
+        const baseBranch = typeof body.baseBranch === 'string' && body.baseBranch.trim() ? body.baseBranch.trim() : undefined;
+        const config = await loadConfig();
+        const workspacePath = resolveWorkspacePath(config.workspacesDir, id);
+        const result = await isolateWorkspaceRepo(workspacePath, repo, {
+            branchName,
+            baseBranch,
+        });
+        return c.json({ success: true, ...result });
+    }
+    catch (error) {
+        return errorResponse(c, error);
+    }
+});
 // 7.8. Suggest workflow strategy based on feature description & selected repos
 app.post('/api/workspace/suggest-workflow', async (c) => {
     try {
@@ -1018,6 +1106,10 @@ app.get('/api/workspace-launch-targets', async (c) => {
 });
 // 8a. Open a real NexusFlow workspace in a selected desktop app or editor.
 app.post('/api/workspace/:id/launch', async (c) => {
+    const origin = c.req.header('origin');
+    if (origin && !hasTrustedLocalOrigin(origin)) {
+        return c.json({ error: 'Forbidden cross-origin request.' }, 403);
+    }
     try {
         const id = decodeURIComponent(c.req.param('id'));
         const { targetId, action = 'new', sessionId } = await c.req.json().catch(() => ({}));
@@ -1079,12 +1171,74 @@ app.post('/api/workspace/:id/launch', async (c) => {
         return errorResponse(c, error);
     }
 });
-// 8b. Legacy editor route retained for older GUI clients using recognized
+// 8b. Launch an external interactive terminal for a workspace or AI session.
+app.post('/api/workspace/:id/terminal', async (c) => {
+    const origin = c.req.header('origin');
+    if (origin && !hasTrustedLocalOrigin(origin)) {
+        return c.json({ error: 'Forbidden cross-origin request.' }, 403);
+    }
+    try {
+        const id = decodeURIComponent(c.req.param('id'));
+        const { command, assistant, sessionId, title } = await c.req.json().catch(() => ({}));
+        if (assistant !== undefined) {
+            if (typeof assistant !== 'string' || !SUPPORTED_ASSISTANTS.has(assistant.trim().toLowerCase())) {
+                return c.json({ error: 'Invalid or unsupported assistant parameter.' }, 400);
+            }
+        }
+        if (sessionId !== undefined) {
+            if (typeof sessionId !== 'string' || !isValidSessionUuid(sessionId)) {
+                return c.json({ error: 'Invalid session UUID format.' }, 400);
+            }
+        }
+        if (command !== undefined && (typeof command !== 'string' || !command.trim())) {
+            return c.json({ error: 'Command must be a non-empty string.' }, 400);
+        }
+        if (title !== undefined && typeof title !== 'string') {
+            return c.json({ error: 'Title must be a string.' }, 400);
+        }
+        const config = await loadConfig();
+        const requestedWorkspacePath = resolveWorkspacePath(config.workspacesDir, id);
+        let workspacePath;
+        try {
+            workspacePath = await resolveExactLaunchWorkspace(config.workspacesDir, requestedWorkspacePath);
+        }
+        catch (error) {
+            if (error instanceof PathAccessError)
+                throw error;
+            return c.json({ error: 'Workspace configuration not found.' }, 404);
+        }
+        if (!workspacePath) {
+            return c.json({ error: 'Workspace configuration not found.' }, 404);
+        }
+        const res = await launchWorkspaceTerminal(workspacePath, {
+            command: typeof command === 'string' ? command : undefined,
+            assistant: typeof assistant === 'string' ? assistant : undefined,
+            sessionId: typeof sessionId === 'string' ? sessionId : undefined,
+            title: typeof title === 'string' ? title : undefined,
+        });
+        return c.json({ success: true, command: res.command });
+    }
+    catch (error) {
+        return errorResponse(c, error);
+    }
+});
+// 8c. Legacy editor route retained for older GUI clients using recognized
 // graphical editors. Interactive terminal editors are intentionally rejected:
 // a detached HTTP request cannot safely provide their required TTY.
 app.post('/api/open-editor', async (c) => {
+    const origin = c.req.header('origin');
+    if (origin && !hasTrustedLocalOrigin(origin)) {
+        return c.json({ error: 'Forbidden cross-origin request.' }, 403);
+    }
     try {
-        const { workspacePath, command } = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
+        const { workspacePath, command } = body;
+        if (typeof workspacePath !== 'string' || !workspacePath.trim()) {
+            return c.json({ error: 'Workspace path does not exist' }, 400);
+        }
+        if (typeof command !== 'string' || !command.trim()) {
+            return c.json({ error: 'Forbidden editor command' }, 400);
+        }
         const targetId = launchTargetIdForEditorCommand(command);
         if (!ALLOWED_EDITORS.has(command) || !targetId) {
             return c.json({ error: 'Forbidden editor command' }, 400);
@@ -1329,10 +1483,10 @@ app.get('/api/workspace/:id/changes', async (c) => {
                     });
                     const numstatLines = numstatRaw.split('\n').filter(Boolean);
                     for (const numLine of numstatLines) {
-                        const parts = numLine.trim().split(/\s+/);
-                        if (parts.length >= 3) {
-                            const [add, del, file] = parts;
-                            numstatMap.set(file, {
+                        const match = numLine.trim().match(/^(\d+|-)\s+(\d+|-)\s+(.*)$/);
+                        if (match) {
+                            const [, add, del, file] = match;
+                            numstatMap.set(file.trim(), {
                                 additions: add === '-' ? 0 : parseInt(add, 10) || 0,
                                 deletions: del === '-' ? 0 : parseInt(del, 10) || 0,
                             });
@@ -1567,6 +1721,10 @@ app.post('/api/workspace/:id/commit', async (c) => {
 });
 // 14. Resume session in workspace (copies CLI resume command and opens editor)
 app.post('/api/workspace/:id/resume', async (c) => {
+    const origin = c.req.header('origin');
+    if (origin && !hasTrustedLocalOrigin(origin)) {
+        return c.json({ error: 'Forbidden cross-origin request.' }, 403);
+    }
     try {
         const id = decodeURIComponent(c.req.param('id'));
         const config = await loadConfig();
@@ -1577,8 +1735,14 @@ app.post('/api/workspace/:id/resume', async (c) => {
             return c.json({ error: 'Workspace configuration not found.' }, 404);
         }
         const body = await c.req.json().catch(() => ({}));
-        const targetSessionId = body.sessionId;
-        const targetAssistant = body.assistant;
+        const targetSessionId = typeof body.sessionId === 'string' && isValidSessionUuid(body.sessionId) ? body.sessionId : undefined;
+        if (body.sessionId !== undefined && targetSessionId === undefined) {
+            return c.json({ error: 'Invalid session UUID format.' }, 400);
+        }
+        if (body.command !== undefined && (typeof body.command !== 'string' || !ALLOWED_EDITORS.has(body.command))) {
+            return c.json({ error: 'Forbidden editor command' }, 400);
+        }
+        const targetAssistant = typeof body.assistant === 'string' ? body.assistant : undefined;
         // Find the session to resume
         let resumeCommand = '';
         let selectedAssistant = targetAssistant || feature.assistants[0] || 'antigravity';
@@ -1628,17 +1792,12 @@ app.post('/api/workspace/:id/resume', async (c) => {
             if (!ALLOWED_EDITORS.has(body.command)) {
                 return c.json({ error: 'Forbidden editor command' }, 400);
             }
-            const isWin = process.platform === 'win32';
-            const child = execa(body.command, [workspacePath], {
-                detached: true,
-                stdio: 'ignore',
-                shell: isWin,
-                cleanup: false,
-            });
-            child.unref();
-            child.catch((err) => {
+            try {
+                await openInEditor(body.command, workspacePath);
+            }
+            catch (err) {
                 console.error(`Failed to launch editor ${body.command} for path ${workspacePath}:`, err);
-            });
+            }
         }
         // Where the resume command should be run: the workspace dir, or the repo
         // root for single-repo in-place features.
@@ -1726,8 +1885,11 @@ app.get('/api/session/:assistant/:sessionId/transcript', async (c) => {
     const assistant = c.req.param('assistant');
     const sessionId = c.req.param('sessionId');
     try {
-        if (assistant === 'codex' && !isValidSessionUuid(sessionId)) {
-            return c.json({ error: 'Invalid Codex session id.' }, 400);
+        if (!SUPPORTED_ASSISTANTS.has(assistant.trim().toLowerCase())) {
+            return c.json({ error: `Unsupported assistant: "${assistant}".` }, 400);
+        }
+        if (!isValidSessionUuid(sessionId)) {
+            return c.json({ error: 'Invalid session UUID format.' }, 400);
         }
         const messages = await getSessionTranscript(assistant, sessionId);
         return c.json({ messages });