@nextclaw/server 0.15.22 → 0.15.24

package/dist/index.js

@@ -4,7 +4,7 @@ import { serve } from "@hono/node-server";
 import { AccessManager, PanelAppError, injectUiContentParamsBootstrap, isInboxDeliveryError, isPanelAppError, isPreferenceError, isProjectError, isServiceAppError, isSessionContextCompactionError, isSessionMessageCursorError, isSessionSettingsError } from "@nextclaw/kernel";
 import { WebSocket, WebSocketServer } from "ws";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { mkdir, open, readFile, readdir, realpath, stat } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as NextclawCore from "@nextclaw/core";
@@ -316,13 +316,15 @@ var EventStreamAuthService = class {
 	authenticateExtension = (request) => {
 		const token = readBearerToken(readHeaderValue(request.headers.authorization));
 		const extensionId = readHeaderValue(request.headers["x-nextclaw-extension-id"]);
+		const generation = readHeaderValue(request.headers["x-nextclaw-extension-generation"]);
 		const result = this.deps.extensionAuth?.authenticateEventStreamCredential({
 			extensionId,
+			generation,
 			token
 		});
 		if (!result) return null;
 		return {
-			principalId: `extension:${result.extensionId}`,
+			principalId: `extension:${result.extensionId}:${result.generation}`,
 			grants: [
 				"event-stream:extension-requests",
 				"event-stream:ncp-events",
@@ -330,7 +332,12 @@ var EventStreamAuthService = class {
 			],
 			scopes: {
 				extensionIds: [result.extensionId],
+				extensionGenerations: [`${result.extensionId}:${result.generation}`],
 				channelIds: this.getExtensionChannelIds(result.extensionId)
+			},
+			extension: {
+				id: result.extensionId,
+				generation: result.generation
 			}
 		};
 	};
@@ -364,7 +371,11 @@ function hasScopeValue(principal, key, value) {
 	return Boolean(value && scopeValues(principal, key).includes(value));
 }
 function readExtensionRequestTarget(event) {
-	return readString(readRecord(event.payload).extensionId);
+	const payload = readRecord(event.payload);
+	return {
+		extensionId: readString(payload.extensionId),
+		generation: readString(payload.generation)
+	};
 }
 function parseAgentSessionChannel(sessionId) {
 	if (!sessionId) return null;
@@ -379,7 +390,10 @@ function readNcpEventChannel(event) {
 	return readString(metadata.channelId) ?? readString(metadata.channel) ?? parseAgentSessionChannel(readString(message.sessionId) ?? readString(payload.sessionId));
 }
 function canStreamAppEventToPrincipal(principal, event) {
-	if (event.type === "extension.request") return hasGrant(principal, "event-stream:extension-requests") && hasScopeValue(principal, "extensionIds", readExtensionRequestTarget(event));
+	if (event.type === "extension.request") {
+		const target = readExtensionRequestTarget(event);
+		return hasGrant(principal, "event-stream:extension-requests") && hasScopeValue(principal, "extensionIds", target.extensionId) && hasScopeValue(principal, "extensionGenerations", target.extensionId && target.generation ? `${target.extensionId}:${target.generation}` : null);
+	}
 	if (event.type === "ncp.event") {
 		if (hasGrant(principal, "event-stream:ui-events")) return true;
 		return hasGrant(principal, "event-stream:ncp-events") && hasScopeValue(principal, "channelIds", readNcpEventChannel(event));
@@ -397,6 +411,13 @@ function canStreamAppEventToPrincipal(principal, event) {
 var EventStreamClientRegistry = class {
 	clients = /* @__PURE__ */ new Set();
 	add = (socket, principal) => {
+		const extensionId = principal.extension?.id;
+		if (extensionId) {
+			for (const existing of this.clients) if (existing.principal.extension?.id === extensionId) {
+				this.clients.delete(existing);
+				existing.socket.close();
+			}
+		}
 		const client = {
 			socket,
 			principal
@@ -453,6 +474,7 @@ const ingressKeys = {
 		channelMessageSubmit: createTypedKey("extension.channel.message.submit"),
 		channelCommandList: createTypedKey("extension.channel.command.list"),
 		channelCommandExecute: createTypedKey("extension.channel.command.execute"),
+		runtimeReady: createTypedKey("extension.runtime.ready"),
 		response: createTypedKey("extension.response")
 	},
 	agentRun: {
@@ -677,6 +699,7 @@ var AppRoutesController = class {
 	}));
 	appMeta = (c) => c.json(ok(buildAppMetaView(this.options)));
 	bootstrapStatus = (c) => c.json(ok(this.options.bootstrapStatus?.getStatus() ?? buildFallbackBootstrapStatus()));
+	extensionRuntimeStatus = (c) => c.json(ok(this.options.extensions?.getRuntimeStatus?.() ?? []));
 };
 //#endregion
 //#region src/features/config/providers/server-builtin-provider.provider.ts
@@ -4816,6 +4839,8 @@ var ServiceAppsRoutesController = class {
 };
 //#endregion
 //#region src/app/utils/ncp-session-event-stream.utils.ts
+const NCP_SESSION_STREAM_HEARTBEAT_INTERVAL_MS = 25e3;
+const NCP_SESSION_STREAM_HEARTBEAT_FRAME = ": keepalive\n\n";
 function readEventSessionId(event) {
 	const payload = "payload" in event ? event.payload : null;
 	if (!payload || typeof payload !== "object") return null;
@@ -4829,8 +4854,13 @@ function createNcpSessionEventStreamResponse(eventBus, payload, signal) {
 	let controller = null;
 	let closed = false;
 	let unsubscribe = () => void 0;
+	let heartbeat = null;
 	const cleanup = () => {
 		unsubscribe();
+		if (heartbeat) {
+			clearInterval(heartbeat);
+			heartbeat = null;
+		}
 		signal.removeEventListener("abort", close);
 	};
 	const close = () => {
@@ -4847,6 +4877,9 @@ function createNcpSessionEventStreamResponse(eventBus, payload, signal) {
 		start: (streamController) => {
 			controller = streamController;
 			unsubscribe = eventBus.on(eventKeys.ncpEvent, push);
+			heartbeat = setInterval(() => {
+				if (!closed && !signal.aborted) controller?.enqueue(encoder.encode(NCP_SESSION_STREAM_HEARTBEAT_FRAME));
+			}, NCP_SESSION_STREAM_HEARTBEAT_INTERVAL_MS);
 			signal.addEventListener("abort", close, { once: true });
 			if (signal.aborted) close();
 		},
@@ -5056,6 +5089,28 @@ function isServerPathBrowseError(error) {
 	return error instanceof ServerPathBrowseError;
 }
 //#endregion
+//#region src/features/server-path/utils/server-path-search.utils.ts
+function isServerPathInside(basePath, candidatePath) {
+	const relativePath = relative(basePath, candidatePath);
+	return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+}
+function normalizeServerPathRelativePath(value) {
+	return value.split(sep).join("/");
+}
+function resolveServerPathSearchScore(entry, query) {
+	if (!query) return 1;
+	const normalizedQuery = query.toLocaleLowerCase();
+	const normalizedName = entry.name.toLocaleLowerCase();
+	const normalizedPath = entry.relativePath.toLocaleLowerCase();
+	if (!normalizedQuery.split(/\s+/).filter(Boolean).every((term) => normalizedPath.includes(term))) return 0;
+	if (normalizedName === normalizedQuery) return 1e3;
+	if (normalizedName.startsWith(normalizedQuery)) return 850;
+	if (normalizedName.includes(normalizedQuery)) return 700;
+	if (normalizedPath.startsWith(normalizedQuery)) return 600;
+	if (normalizedPath.split("/").some((segment) => segment.startsWith(normalizedQuery))) return 550;
+	return 400 - Math.min(normalizedPath.length, 300);
+}
+//#endregion
 //#region src/features/server-path/utils/server-path-directory.utils.ts
 var ServerPathDirectoryCreateError = class extends Error {
 	constructor(code, message) {
@@ -5069,28 +5124,46 @@ function normalizeDirectoryName(value) {
 	if (!name || name === "." || name === ".." || name.includes("/") || name.includes("\\")) throw new ServerPathDirectoryCreateError("SERVER_PATH_DIRECTORY_NAME_INVALID", "directory name is invalid");
 	return name;
 }
-function readFileErrorCode(error) {
+function readFileErrorCode$1(error) {
 	return typeof error === "object" && error !== null && "code" in error ? String(error.code ?? "") : void 0;
 }
-async function createServerPathDirectory(input) {
-	let parentPath;
+function resolveDirectoryPath(value) {
 	try {
-		parentPath = resolveServerPath({ path: typeof input.parentPath === "string" ? input.parentPath : null });
+		return resolveServerPath({ path: typeof value === "string" ? value : null });
 	} catch (error) {
 		if (error instanceof ServerPathResolutionError) throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_INVALID", error.message);
 		throw error;
 	}
+}
+async function assertParentInsideBase(baseValue, parentPath) {
+	if (typeof baseValue !== "string" || !baseValue.trim()) return;
+	const basePath = resolveDirectoryPath(baseValue);
+	if (!isServerPathInside(basePath, parentPath)) throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_INVALID", "parent path must stay inside the project root");
+	try {
+		const [realBasePath, realParentPath] = await Promise.all([realpath(basePath), realpath(parentPath)]);
+		if (!isServerPathInside(realBasePath, realParentPath)) throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_INVALID", "parent path must stay inside the project root");
+	} catch (error) {
+		if (error instanceof ServerPathDirectoryCreateError) throw error;
+		throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_INVALID", "project root and parent path must exist");
+	}
+}
+function throwDirectoryCreationError(error) {
+	const code = readFileErrorCode$1(error);
+	if (code === "EEXIST") throw new ServerPathDirectoryCreateError("SERVER_PATH_DIRECTORY_EXISTS", "directory already exists");
+	if (code === "ENOENT") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_FOUND", "parent directory does not exist");
+	if (code === "ENOTDIR") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_DIRECTORY", "parent path must point to a directory");
+	if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_WRITABLE", "parent directory is not writable");
+	throw error;
+}
+async function createServerPathDirectory(input) {
+	const parentPath = resolveDirectoryPath(input.parentPath);
+	await assertParentInsideBase(input.basePath, parentPath);
 	const directoryPath = join(parentPath, normalizeDirectoryName(input.name));
 	try {
 		await mkdir(directoryPath);
 		return { path: directoryPath };
 	} catch (error) {
-		const code = readFileErrorCode(error);
-		if (code === "EEXIST") throw new ServerPathDirectoryCreateError("SERVER_PATH_DIRECTORY_EXISTS", "directory already exists");
-		if (code === "ENOENT") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_FOUND", "parent directory does not exist");
-		if (code === "ENOTDIR") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_DIRECTORY", "parent path must point to a directory");
-		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathDirectoryCreateError("SERVER_PATH_PARENT_NOT_WRITABLE", "parent directory is not writable");
-		throw error;
+		throwDirectoryCreationError(error);
 	}
 }
 function isServerPathDirectoryCreateError(error) {
@@ -5382,28 +5455,6 @@ function isServerPathContentError(error) {
 	return error instanceof ServerPathContentError;
 }
 //#endregion
-//#region src/features/server-path/utils/server-path-search.utils.ts
-function isServerPathInside(basePath, candidatePath) {
-	const relativePath = relative(basePath, candidatePath);
-	return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
-}
-function normalizeServerPathRelativePath(value) {
-	return value.split(sep).join("/");
-}
-function resolveServerPathSearchScore(entry, query) {
-	if (!query) return 1;
-	const normalizedQuery = query.toLocaleLowerCase();
-	const normalizedName = entry.name.toLocaleLowerCase();
-	const normalizedPath = entry.relativePath.toLocaleLowerCase();
-	if (!normalizedQuery.split(/\s+/).filter(Boolean).every((term) => normalizedPath.includes(term))) return 0;
-	if (normalizedName === normalizedQuery) return 1e3;
-	if (normalizedName.startsWith(normalizedQuery)) return 850;
-	if (normalizedName.includes(normalizedQuery)) return 700;
-	if (normalizedPath.startsWith(normalizedQuery)) return 600;
-	if (normalizedPath.split("/").some((segment) => segment.startsWith(normalizedQuery))) return 550;
-	return 400 - Math.min(normalizedPath.length, 300);
-}
-//#endregion
 //#region src/features/server-path/services/server-path-search.service.ts
 const DEFAULT_RESULT_LIMIT = 50;
 const MAX_RESULT_LIMIT = 100;
@@ -5591,6 +5642,199 @@ function isServerPathSearchError(error) {
 	return error instanceof ServerPathSearchError;
 }
 //#endregion
+//#region src/features/server-path/utils/server-path-mutation.utils.ts
+var ServerPathMutationError = class extends Error {
+	constructor(code, message, details) {
+		super(message);
+		this.code = code;
+		this.details = details;
+		this.name = "ServerPathMutationError";
+	}
+};
+function readFileErrorCode(error) {
+	return typeof error === "object" && error !== null && "code" in error ? String(error.code ?? "") : void 0;
+}
+function resolveScopedPaths(input) {
+	let basePath;
+	let targetPath;
+	try {
+		basePath = resolveServerPath({ path: typeof input.basePath === "string" ? input.basePath : null });
+		targetPath = resolveServerPath({
+			path: typeof input.targetPath === "string" ? input.targetPath : null,
+			basePath
+		});
+	} catch (error) {
+		if (error instanceof ServerPathResolutionError) throw new ServerPathMutationError("SERVER_PATH_BASE_INVALID", error.message);
+		throw error;
+	}
+	if (!isServerPathInside(basePath, targetPath)) throw new ServerPathMutationError("SERVER_PATH_OUTSIDE_BASE", "target path must stay inside the project root");
+	if (!input.allowRoot && targetPath === basePath) throw new ServerPathMutationError("SERVER_PATH_ROOT_PROTECTED", "the project root cannot be deleted");
+	return {
+		basePath,
+		targetPath
+	};
+}
+async function resolveRealBasePath(basePath) {
+	try {
+		const resolved = await realpath(basePath);
+		if (!(await stat(resolved)).isDirectory()) throw new ServerPathMutationError("SERVER_PATH_BASE_INVALID", "project root must point to a directory");
+		return resolved;
+	} catch (error) {
+		if (error instanceof ServerPathMutationError) throw error;
+		throw new ServerPathMutationError("SERVER_PATH_BASE_INVALID", "project root does not exist or is not accessible");
+	}
+}
+async function assertExistingPathInsideRealBase(params) {
+	const [realBasePath, realTargetPath] = await Promise.all([resolveRealBasePath(params.basePath), realpath(params.targetPath).catch(() => null)]);
+	if (!realTargetPath) throw new ServerPathMutationError("SERVER_PATH_ENTRY_NOT_FOUND", "target path does not exist");
+	if (!isServerPathInside(realBasePath, realTargetPath)) throw new ServerPathMutationError("SERVER_PATH_OUTSIDE_BASE", "target path must stay inside the project root");
+}
+function normalizeEntryName(value) {
+	const name = typeof value === "string" ? value.trim() : "";
+	if (!name || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.includes("\0") || basename(name) !== name) throw new ServerPathMutationError("SERVER_PATH_FILE_NAME_INVALID", "entry name is invalid");
+	return name;
+}
+async function createServerPathFile(input) {
+	const { basePath, targetPath: parentPath } = resolveScopedPaths({
+		basePath: input.basePath,
+		targetPath: input.parentPath,
+		allowRoot: true
+	});
+	await assertExistingPathInsideRealBase({
+		basePath,
+		targetPath: parentPath
+	});
+	if (!(await stat(parentPath).catch(() => null))?.isDirectory()) throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_DIRECTORY", "file parent must point to a directory");
+	const name = normalizeEntryName(input.name);
+	const path = join(parentPath, name);
+	try {
+		await writeFile(path, "", { flag: "wx" });
+	} catch (error) {
+		const code = readFileErrorCode(error);
+		if (code === "EEXIST") throw new ServerPathMutationError("SERVER_PATH_FILE_EXISTS", "target file already exists");
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_WRITABLE", "file parent is not writable");
+		throw error;
+	}
+	return {
+		name,
+		path,
+		kind: "file"
+	};
+}
+async function renameServerPathEntry(input) {
+	const { basePath, targetPath } = resolveScopedPaths({
+		basePath: input.basePath,
+		targetPath: input.path
+	});
+	await assertExistingPathInsideRealBase({
+		basePath,
+		targetPath
+	});
+	const entryStats = await lstat(targetPath).catch(() => null);
+	if (!entryStats) throw new ServerPathMutationError("SERVER_PATH_ENTRY_NOT_FOUND", "target path does not exist");
+	const name = normalizeEntryName(input.name);
+	const path = join(resolve(targetPath, ".."), name);
+	if (!isServerPathInside(basePath, path)) throw new ServerPathMutationError("SERVER_PATH_OUTSIDE_BASE", "target path must stay inside the project root");
+	if (await lstat(path).then(() => true).catch(() => false)) throw new ServerPathMutationError("SERVER_PATH_FILE_EXISTS", "target entry already exists");
+	try {
+		await rename(targetPath, path);
+	} catch (error) {
+		const code = readFileErrorCode(error);
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_WRITABLE", "target path is not writable");
+		throw error;
+	}
+	return {
+		oldPath: targetPath,
+		path,
+		name,
+		kind: entryStats.isDirectory() ? "directory" : "file"
+	};
+}
+async function deleteServerPathEntry(input) {
+	const { basePath, targetPath } = resolveScopedPaths({
+		basePath: input.basePath,
+		targetPath: input.path
+	});
+	await assertExistingPathInsideRealBase({
+		basePath,
+		targetPath
+	});
+	let entryStats;
+	try {
+		entryStats = await lstat(targetPath);
+	} catch {
+		throw new ServerPathMutationError("SERVER_PATH_ENTRY_NOT_FOUND", "target path does not exist");
+	}
+	const kind = entryStats.isDirectory() ? "directory" : "file";
+	try {
+		await rm(targetPath, {
+			recursive: kind === "directory",
+			force: false
+		});
+	} catch (error) {
+		const code = readFileErrorCode(error);
+		if (code === "ENOENT") throw new ServerPathMutationError("SERVER_PATH_ENTRY_NOT_FOUND", "target path does not exist");
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_WRITABLE", "target path is not writable");
+		throw error;
+	}
+	return {
+		path: targetPath,
+		kind
+	};
+}
+async function uploadServerPathFiles(input) {
+	const { basePath, targetPath } = resolveScopedPaths({
+		basePath: input.basePath,
+		targetPath: input.targetPath,
+		allowRoot: true
+	});
+	await assertExistingPathInsideRealBase({
+		basePath,
+		targetPath
+	});
+	if (!(await stat(targetPath).catch(() => null))?.isDirectory()) throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_DIRECTORY", "upload target must point to a directory");
+	if (input.files.length === 0) throw new ServerPathMutationError("SERVER_PATH_ENTRY_INVALID", "at least one upload file is required");
+	const normalizedFiles = input.files.map((file) => ({
+		file,
+		name: normalizeEntryName(file.name)
+	}));
+	const uniqueNames = /* @__PURE__ */ new Set();
+	for (const { name } of normalizedFiles) {
+		if (uniqueNames.has(name)) throw new ServerPathMutationError("SERVER_PATH_FILE_NAME_INVALID", "upload file names must be unique");
+		uniqueNames.add(name);
+	}
+	if (!input.overwrite) {
+		const conflicts = (await Promise.all(normalizedFiles.map(async ({ name }) => {
+			return await lstat(join(targetPath, name)).then(() => true).catch(() => false) ? name : null;
+		}))).filter((name) => Boolean(name));
+		if (conflicts.length > 0) throw new ServerPathMutationError("SERVER_PATH_FILE_EXISTS", "one or more upload files already exist", { conflicts });
+	}
+	try {
+		return {
+			files: await Promise.all(normalizedFiles.map(async ({ file, name }) => {
+				const path = resolve(targetPath, name);
+				const content = Buffer.from(await file.arrayBuffer());
+				await writeFile(path, content, { flag: input.overwrite ? "w" : "wx" });
+				return {
+					name,
+					path,
+					sizeBytes: content.byteLength
+				};
+			})),
+			overwritten: input.overwrite
+		};
+	} catch (error) {
+		const code = readFileErrorCode(error);
+		if (code === "EEXIST") throw new ServerPathMutationError("SERVER_PATH_FILE_EXISTS", "one or more upload files already exist");
+		if (code === "ENOENT" || code === "ENOTDIR") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_DIRECTORY", "upload target must point to an existing directory");
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new ServerPathMutationError("SERVER_PATH_TARGET_NOT_WRITABLE", "upload target is not writable");
+		throw error;
+	}
+}
+function isServerPathMutationError(error) {
+	return error instanceof ServerPathMutationError;
+}
+//#endregion
 //#region src/features/server-path/controllers/server-path.controller.ts
 function readIncludeFilesFlag(value) {
 	return value === "1" || value === "true";
@@ -5638,6 +5882,7 @@ var ServerPathRoutesController = class {
 		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_DIRECTORY", "directory input is required"), 400);
 		try {
 			return c.json(ok(await createServerPathDirectory({
+				basePath: body.data.basePath,
 				parentPath: body.data.parentPath,
 				name: body.data.name
 			})), 201);
@@ -5646,6 +5891,68 @@ var ServerPathRoutesController = class {
 			throw error;
 		}
 	};
+	uploadFiles = async (c) => {
+		let formData;
+		try {
+			formData = await c.req.raw.formData();
+		} catch {
+			return c.json(err("INVALID_SERVER_PATH_UPLOAD", "multipart upload is required"), 400);
+		}
+		const files = formData.getAll("files").flatMap((value) => typeof value === "string" ? [] : [{
+			name: value.name,
+			arrayBuffer: () => value.arrayBuffer()
+		}]);
+		try {
+			return c.json(ok(await uploadServerPathFiles({
+				basePath: formData.get("basePath"),
+				targetPath: formData.get("targetPath"),
+				overwrite: formData.get("overwrite") === "true",
+				files
+			})), 201);
+		} catch (error) {
+			if (isServerPathMutationError(error)) return c.json(err(error.code, error.message, error.details), error.code === "SERVER_PATH_FILE_EXISTS" ? 409 : 400);
+			throw error;
+		}
+	};
+	createFile = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_FILE", "file input is required"), 400);
+		try {
+			return c.json(ok(await createServerPathFile({
+				basePath: body.data.basePath,
+				parentPath: body.data.parentPath,
+				name: body.data.name
+			})), 201);
+		} catch (error) {
+			if (isServerPathMutationError(error)) return c.json(err(error.code, error.message, error.details), error.code === "SERVER_PATH_FILE_EXISTS" ? 409 : 400);
+			throw error;
+		}
+	};
+	renameEntry = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_RENAME", "rename input is required"), 400);
+		try {
+			return c.json(ok(await renameServerPathEntry({
+				basePath: body.data.basePath,
+				path: body.data.path,
+				name: body.data.name
+			})));
+		} catch (error) {
+			if (isServerPathMutationError(error)) return c.json(err(error.code, error.message, error.details), error.code === "SERVER_PATH_FILE_EXISTS" ? 409 : 400);
+			throw error;
+		}
+	};
+	deleteEntry = async (c) => {
+		try {
+			return c.json(ok(await deleteServerPathEntry({
+				basePath: c.req.query("basePath"),
+				path: c.req.query("path")
+			})));
+		} catch (error) {
+			if (isServerPathMutationError(error)) return c.json(err(error.code, error.message, error.details), 400);
+			throw error;
+		}
+	};
 	read = async (c) => {
 		try {
 			const payload = await readServerPath({
@@ -6072,6 +6379,26 @@ var UiRouteRegistry = class {
 				"/api/server-paths/directory",
 				serverPath.createDirectory
 			],
+			[
+				"post",
+				"/api/server-paths/file",
+				serverPath.createFile
+			],
+			[
+				"post",
+				"/api/server-paths/files",
+				serverPath.uploadFiles
+			],
+			[
+				"patch",
+				"/api/server-paths/entry",
+				serverPath.renameEntry
+			],
+			[
+				"delete",
+				"/api/server-paths/entry",
+				serverPath.deleteEntry
+			],
 			[
 				"get",
 				"/api/server-paths/read",
@@ -6107,6 +6434,11 @@ var UiRouteRegistry = class {
 				"/api/runtime/bootstrap-status",
 				app.bootstrapStatus
 			],
+			[
+				"get",
+				"/api/runtime/extensions",
+				app.extensionRuntimeStatus
+			],
 			[
 				"get",
 				"/api/auth/status",