@nodetool-ai/websocket 0.7.0-rc.11

package/dist/agent/socket-route.js

@@ -0,0 +1,262 @@
+/**
+ * WebSocket route + transport for the agent runtime.
+ *
+ * Each connection at `/ws/agent` gets its own `AgentSocketTransport` instance
+ * that bridges agent-runtime events to the renderer over the socket using
+ * the JSON message protocol defined in `./types.ts`.
+ */
+import { randomUUID } from "node:crypto";
+import { createLogger } from "@nodetool-ai/config";
+import { getAgentRuntime } from "./agent-runtime.js";
+import { clearMcpFrontendTransport } from "../mcp-server.js";
+import { validateAgentClientMessage } from "./types.js";
+const log = createLogger("nodetool.websocket.agent.route");
+const TOOLS_RESPONSE_TIMEOUT_MS = 15000;
+class AgentSocketTransport {
+    socket;
+    alive = true;
+    pendingManifest = new Map();
+    pendingTools = new Map();
+    constructor(socket) {
+        this.socket = socket;
+    }
+    get isAlive() {
+        return this.alive && this.socket.readyState === 1;
+    }
+    send(message) {
+        if (!this.isAlive)
+            return;
+        try {
+            this.socket.send(JSON.stringify(message));
+        }
+        catch (error) {
+            log.warn(`Failed to send agent message: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    streamMessage(sessionId, message, done) {
+        this.send({
+            type: "agent_stream_message",
+            session_id: sessionId,
+            message,
+            done,
+        });
+    }
+    requestToolManifest(sessionId) {
+        return new Promise((resolve, reject) => {
+            const requestId = randomUUID();
+            const timer = setTimeout(() => {
+                this.pendingManifest.delete(requestId);
+                reject(new Error(`Timed out waiting for renderer tool manifest (${TOOLS_RESPONSE_TIMEOUT_MS}ms)`));
+            }, TOOLS_RESPONSE_TIMEOUT_MS);
+            this.pendingManifest.set(requestId, { resolve, reject, timer });
+            this.send({
+                type: "tools_manifest_request",
+                request_id: requestId,
+                session_id: sessionId,
+            });
+        });
+    }
+    executeTool(sessionId, toolCallId, name, args) {
+        return new Promise((resolve, reject) => {
+            const requestId = randomUUID();
+            const timer = setTimeout(() => {
+                this.pendingTools.delete(requestId);
+                reject(new Error(`Timed out waiting for renderer to execute tool ${name} (${TOOLS_RESPONSE_TIMEOUT_MS}ms)`));
+            }, TOOLS_RESPONSE_TIMEOUT_MS);
+            this.pendingTools.set(requestId, { resolve, reject, timer });
+            this.send({
+                type: "tool_call_request",
+                request_id: requestId,
+                session_id: sessionId,
+                tool_call_id: toolCallId,
+                name,
+                args,
+            });
+        });
+    }
+    abortTools(sessionId) {
+        this.send({ type: "tool_call_abort", session_id: sessionId });
+    }
+    /** Renderer replied to a `tools_manifest_request`. */
+    resolveManifest(requestId, manifest) {
+        const pending = this.pendingManifest.get(requestId);
+        if (!pending)
+            return;
+        this.pendingManifest.delete(requestId);
+        clearTimeout(pending.timer);
+        pending.resolve(manifest);
+    }
+    /** Renderer replied to a `tool_call_request`. */
+    resolveTool(requestId, result) {
+        const pending = this.pendingTools.get(requestId);
+        if (!pending)
+            return;
+        this.pendingTools.delete(requestId);
+        clearTimeout(pending.timer);
+        if (result.isError) {
+            pending.reject(new Error(result.error ?? "Tool execution failed"));
+        }
+        else {
+            pending.resolve(result.result);
+        }
+    }
+    /** Mark the transport as dead and reject all in-flight renderer requests. */
+    dispose() {
+        this.alive = false;
+        const failure = new Error("Renderer disconnected");
+        for (const [, pending] of this.pendingManifest) {
+            clearTimeout(pending.timer);
+            pending.reject(failure);
+        }
+        this.pendingManifest.clear();
+        for (const [, pending] of this.pendingTools) {
+            clearTimeout(pending.timer);
+            pending.reject(failure);
+        }
+        this.pendingTools.clear();
+    }
+}
+const agentSocketRoute = async (app) => {
+    app.get("/ws/agent", { websocket: true }, (socket, req) => {
+        // The global auth preHandler in server.ts populates req.userId — reject
+        // the connection if it ever leaks through unauthenticated. Belt and
+        // suspenders: defaults like a misconfigured local dev server should
+        // never become an unauthenticated agent endpoint.
+        const userId = req.userId;
+        if (!userId) {
+            log.warn("Agent WebSocket connection rejected: no userId on request");
+            try {
+                socket.close(1008, "Authentication required");
+            }
+            catch {
+                // socket may already be closing — best effort
+            }
+            return;
+        }
+        const transport = new AgentSocketTransport(socket);
+        const runtime = getAgentRuntime();
+        log.info(`Agent WebSocket client connected (user ${userId})`);
+        const sendResponse = (requestId, data, error) => {
+            transport.send({
+                type: "response",
+                request_id: requestId,
+                data,
+                error,
+            });
+        };
+        const handleCommand = async (msg) => {
+            try {
+                switch (msg.command) {
+                    case "create_session": {
+                        const sessionId = await runtime.createSession(msg.options, userId);
+                        sendResponse(msg.request_id, sessionId);
+                        return;
+                    }
+                    case "send_message": {
+                        // Don't await — runtime streams replies via transport.streamMessage.
+                        // Fire-and-forget the response so the renderer knows the command was accepted.
+                        sendResponse(msg.request_id);
+                        try {
+                            await runtime.sendMessageStreaming(msg.session_id, msg.message, transport, userId);
+                        }
+                        catch (error) {
+                            const message = error instanceof Error ? error.message : String(error);
+                            log.error(`sendMessage failed for ${msg.session_id}: ${message}`);
+                            transport.streamMessage(msg.session_id, {
+                                type: "result",
+                                uuid: randomUUID(),
+                                session_id: msg.session_id,
+                                subtype: "error",
+                                is_error: true,
+                                errors: [message],
+                            }, true);
+                        }
+                        return;
+                    }
+                    case "stop_execution": {
+                        await runtime.stopExecution(msg.session_id, userId);
+                        sendResponse(msg.request_id);
+                        return;
+                    }
+                    case "close_session": {
+                        runtime.closeSession(msg.session_id, userId);
+                        sendResponse(msg.request_id);
+                        return;
+                    }
+                    case "list_models": {
+                        const models = await runtime.listModels(msg.options, userId);
+                        sendResponse(msg.request_id, models);
+                        return;
+                    }
+                    case "list_sessions": {
+                        const sessions = await runtime.listSessionsForRequest(msg.options, userId);
+                        sendResponse(msg.request_id, sessions);
+                        return;
+                    }
+                    case "get_session_messages": {
+                        const messages = await runtime.getSessionMessagesForRequest(msg.options, userId);
+                        sendResponse(msg.request_id, messages);
+                        return;
+                    }
+                    case "tools_manifest_response": {
+                        transport.resolveManifest(msg.request_id, msg.manifest);
+                        return;
+                    }
+                    case "tool_call_response": {
+                        transport.resolveTool(msg.request_id, msg.result);
+                        return;
+                    }
+                    default: {
+                        const exhaustive = msg;
+                        log.warn(`Unknown agent command: ${JSON.stringify(exhaustive)}`);
+                    }
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                log.error(`Agent command failed: ${message}`);
+                if ("request_id" in msg && typeof msg.request_id === "string") {
+                    sendResponse(msg.request_id, undefined, message);
+                }
+            }
+        };
+        socket.on("message", (raw) => {
+            let rawParsed;
+            try {
+                const text = raw.toString();
+                rawParsed = JSON.parse(text);
+            }
+            catch (error) {
+                log.warn(`Failed to parse agent client message: ${error instanceof Error ? error.message : String(error)}`);
+                return;
+            }
+            const validation = validateAgentClientMessage(rawParsed);
+            if (!validation.ok) {
+                log.warn(`Rejecting malformed agent client message: ${validation.error}`);
+                // If the sender provided a request_id, surface the validation error
+                // back to them so they can fix the call. Otherwise the message gets
+                // dropped silently (which is correct — there's nothing to respond to).
+                const maybeRequestId = rawParsed &&
+                    typeof rawParsed === "object" &&
+                    typeof rawParsed.request_id === "string"
+                    ? rawParsed.request_id
+                    : null;
+                if (maybeRequestId) {
+                    sendResponse(maybeRequestId, undefined, validation.error);
+                }
+                return;
+            }
+            void handleCommand(validation.value);
+        });
+        socket.on("close", () => {
+            log.info("Agent WebSocket client disconnected");
+            transport.dispose();
+            clearMcpFrontendTransport(transport);
+        });
+        socket.on("error", (error) => {
+            log.error("Agent WebSocket error", error);
+        });
+    });
+};
+export default agentSocketRoute;
+//# sourceMappingURL=socket-route.js.map

package/dist/agent/socket-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-route.js","sourceRoot":"","sources":["../../src/agent/socket-route.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAQ7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,GAAG,GAAG,YAAY,CAAC,gCAAgC,CAAC,CAAC;AAE3D,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAQxC,MAAM,oBAAoB;IAWK;IAVrB,KAAK,GAAG,IAAI,CAAC;IACJ,eAAe,GAAG,IAAI,GAAG,EAGvC,CAAC;IACa,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ,YAA6B,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;IAAG,CAAC;IAElD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAA2B;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CACN,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,OAAqB,EAAE,IAAa;QACnE,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,sBAAsB;YAC5B,UAAU,EAAE,SAAS;YACrB,OAAO;YACP,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,SAAiB;QACnC,OAAO,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACvC,MAAM,CACJ,IAAI,KAAK,CACP,iDAAiD,yBAAyB,KAAK,CAChF,CACF,CAAC;YACJ,CAAC,EAAE,yBAAyB,CAAC,CAAC;YAC9B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,wBAAwB;gBAC9B,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CACT,SAAiB,EACjB,UAAkB,EAClB,IAAY,EACZ,IAAa;QAEb,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACpC,MAAM,CACJ,IAAI,KAAK,CACP,kDAAkD,IAAI,KAAK,yBAAyB,KAAK,CAC1F,CACF,CAAC;YACJ,CAAC,EAAE,yBAAyB,CAAC,CAAC;YAC9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,mBAAmB;gBACzB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,UAAU;gBACxB,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IACtD,eAAe,CAAC,SAAiB,EAAE,QAAgC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,iDAAiD;IACjD,WAAW,CACT,SAAiB,EACjB,MAA8D;QAE9D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,OAAO;QACL,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,gBAAgB,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACxD,wEAAwE;QACxE,oEAAoE;QACpE,oEAAoE;QACpE,kDAAkD;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,GAAG,CAAC,IAAI,CAAC,0CAA0C,MAAM,GAAG,CAAC,CAAC;QAE9D,MAAM,YAAY,GAAG,CACnB,SAAiB,EACjB,IAAc,EACd,KAAc,EACR,EAAE;YACR,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,SAAS;gBACrB,IAAI;gBACJ,KAAK;aACN,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,KAAK,EAAE,GAAuB,EAAiB,EAAE;YACrE,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;oBACpB,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;wBACnE,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;wBACxC,OAAO;oBACT,CAAC;oBACD,KAAK,cAAc,CAAC,CAAC,CAAC;wBACpB,qEAAqE;wBACrE,+EAA+E;wBAC/E,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;wBAC7B,IAAI,CAAC;4BACH,MAAM,OAAO,CAAC,oBAAoB,CAChC,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,OAAO,EACX,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;4BACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC;4BAClE,SAAS,CAAC,aAAa,CACrB,GAAG,CAAC,UAAU,EACd;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,UAAU,EAAE;gCAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gCAC1B,OAAO,EAAE,OAAO;gCAChB,QAAQ,EAAE,IAAI;gCACd,MAAM,EAAE,CAAC,OAAO,CAAC;6BAClB,EACD,IAAI,CACL,CAAC;wBACJ,CAAC;wBACD,OAAO;oBACT,CAAC;oBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;wBACpD,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;wBAC7C,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,KAAK,aAAa,CAAC,CAAC,CAAC;wBACnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;wBAC7D,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;wBACrC,OAAO;oBACT,CAAC;oBACD,KAAK,eAAe,CAAC,CAAC,CAAC;wBACrB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,sBAAsB,CACnD,GAAG,CAAC,OAAO,EACX,MAAM,CACP,CAAC;wBACF,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;wBACvC,OAAO;oBACT,CAAC;oBACD,KAAK,sBAAsB,CAAC,CAAC,CAAC;wBAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,4BAA4B,CACzD,GAAG,CAAC,OAAO,EACX,MAAM,CACP,CAAC;wBACF,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;wBACvC,OAAO;oBACT,CAAC;oBACD,KAAK,yBAAyB,CAAC,CAAC,CAAC;wBAC/B,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;wBACxD,OAAO;oBACT,CAAC;oBACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;wBAC1B,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;wBAClD,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,GAAG,CAAC;wBAC9B,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,GAAG,CAAC,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;gBAC9C,IAAI,YAAY,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;oBAC9D,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoC,EAAE,EAAE;YAC5D,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,IAAI,CACN,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CACN,6CAA6C,UAAU,CAAC,KAAK,EAAE,CAChE,CAAC;gBACF,oEAAoE;gBACpE,oEAAoE;gBACpE,uEAAuE;gBACvE,MAAM,cAAc,GAClB,SAAS;oBACT,OAAO,SAAS,KAAK,QAAQ;oBAC7B,OAAQ,SAAqC,CAAC,UAAU,KAAK,QAAQ;oBACnE,CAAC,CAAG,SAAqC,CAAC,UAAqB;oBAC/D,CAAC,CAAC,IAAI,CAAC;gBACX,IAAI,cAAc,EAAE,CAAC;oBACnB,YAAY,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO;YACT,CAAC;YAED,KAAK,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YAChD,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YAClC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/agent/transport.d.ts

@@ -0,0 +1,39 @@
+/**
+ * AgentTransport — abstract bridge between the agent runtime and a renderer.
+ *
+ * The agent runtime (Claude/Codex/OpenCode SDKs) needs to:
+ *   1. Stream agent messages back to the renderer.
+ *   2. Ask the renderer for the available frontend-tool manifest.
+ *   3. Ask the renderer to execute a frontend tool and await its result.
+ *   4. Tell the renderer to abort any pending tool calls.
+ *
+ * In the legacy Electron architecture this was done via Electron IPC
+ * (`webContents.send` / `ipcMain.on`). The WebSocket-based architecture
+ * provides the same operations over a `ws://.../ws/agent` connection.
+ *
+ * Implementations live next to their transport (see `socketTransport.ts`).
+ */
+import type { AgentMessage, FrontendToolManifest } from "./types.js";
+export interface AgentTransport {
+    /**
+     * Push a streaming message for `sessionId` to the renderer.
+     * `done=true` signals the end of a turn so the renderer can flush state.
+     */
+    streamMessage(sessionId: string, message: AgentMessage, done: boolean): void;
+    /**
+     * Ask the renderer for the current frontend-tool manifest.
+     * Resolves with the manifest array (possibly empty if unavailable).
+     * Rejects on timeout or transport error.
+     */
+    requestToolManifest(sessionId: string): Promise<FrontendToolManifest[]>;
+    /**
+     * Ask the renderer to execute a frontend tool. Resolves with the tool
+     * result, rejects on error or timeout.
+     */
+    executeTool(sessionId: string, toolCallId: string, name: string, args: unknown): Promise<unknown>;
+    /** Tell the renderer to abort any pending tool calls for the session. */
+    abortTools(sessionId: string): void;
+    /** True if the underlying transport is still attached. */
+    readonly isAlive: boolean;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/agent/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/agent/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAE7E;;;;OAIG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAExE;;;OAGG;IACH,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,yEAAyE;IACzE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B"}

package/dist/agent/transport.js

@@ -0,0 +1,17 @@
+/**
+ * AgentTransport — abstract bridge between the agent runtime and a renderer.
+ *
+ * The agent runtime (Claude/Codex/OpenCode SDKs) needs to:
+ *   1. Stream agent messages back to the renderer.
+ *   2. Ask the renderer for the available frontend-tool manifest.
+ *   3. Ask the renderer to execute a frontend tool and await its result.
+ *   4. Tell the renderer to abort any pending tool calls.
+ *
+ * In the legacy Electron architecture this was done via Electron IPC
+ * (`webContents.send` / `ipcMain.on`). The WebSocket-based architecture
+ * provides the same operations over a `ws://.../ws/agent` connection.
+ *
+ * Implementations live next to their transport (see `socketTransport.ts`).
+ */
+export {};
+//# sourceMappingURL=transport.js.map

package/dist/agent/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/agent/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/agent/types.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Agent WebSocket protocol types.
+ *
+ * The canonical definitions live in `@nodetool-ai/protocol` so both server and
+ * renderer can import the exact same shapes. This file re-exports them so
+ * callers within `@nodetool-ai/websocket` can keep using a single local import
+ * path.
+ */
+export type { AgentProvider, AgentModelDescriptor, AgentModelParams, AgentSessionOptions, AgentModelsRequest, AgentListSessionsRequest, AgentSessionInfoEntry, AgentGetSessionMessagesRequest, AgentTranscriptMessage, AgentMessage, FrontendToolManifest, AgentClientMessage, AgentClientCommand, AgentClientPayload, AgentServerMessage, } from "@nodetool-ai/protocol";
+export { validateAgentClientMessage } from "@nodetool-ai/protocol";
+//# sourceMappingURL=types.d.ts.map

package/dist/agent/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,8BAA8B,EAC9B,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/agent/types.js

@@ -0,0 +1,10 @@
+/**
+ * Agent WebSocket protocol types.
+ *
+ * The canonical definitions live in `@nodetool-ai/protocol` so both server and
+ * renderer can import the exact same shapes. This file re-exports them so
+ * callers within `@nodetool-ai/websocket` can keep using a single local import
+ * path.
+ */
+export { validateAgentClientMessage } from "@nodetool-ai/protocol";
+//# sourceMappingURL=types.js.map

package/dist/agent/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAoBH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/collection-api.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Collection API — REST handler for the multipart file-upload endpoint.
+ *
+ * `/api/collections/:name/index` stays on REST because tRPC's JSON link does
+ * not handle `multipart/form-data` bodies. All CRUD + query endpoints have
+ * moved to the tRPC `collections` router.
+ */
+import type { HttpApiOptions } from "./http-api.js";
+/**
+ * Handle POST /api/collections/:name/index (multipart/form-data file upload).
+ * Returns `null` for any non-matching path so callers can fall through.
+ */
+export declare function handleCollectionRequest(request: Request, pathname: string, _options: HttpApiOptions): Promise<Response | null>;
+//# sourceMappingURL=collection-api.d.ts.map

package/dist/collection-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection-api.d.ts","sourceRoot":"","sources":["../src/collection-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAoBpD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoD1B"}

package/dist/collection-api.js

@@ -0,0 +1,75 @@
+/**
+ * Collection API — REST handler for the multipart file-upload endpoint.
+ *
+ * `/api/collections/:name/index` stays on REST because tRPC's JSON link does
+ * not handle `multipart/form-data` bodies. All CRUD + query endpoints have
+ * moved to the tRPC `collections` router.
+ */
+import { getVecStore, VecNotFoundError, splitDocument } from "@nodetool-ai/vectorstore";
+function jsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { "content-type": "application/json" }
+    });
+}
+function errorResponse(status, detail) {
+    return jsonResponse({ detail }, status);
+}
+function normalizePath(pathname) {
+    if (pathname.length > 1 && pathname.endsWith("/")) {
+        return pathname.slice(0, -1);
+    }
+    return pathname;
+}
+/**
+ * Handle POST /api/collections/:name/index (multipart/form-data file upload).
+ * Returns `null` for any non-matching path so callers can fall through.
+ */
+export async function handleCollectionRequest(request, pathname, _options) {
+    pathname = normalizePath(pathname);
+    const indexMatch = pathname.match(/^\/api\/collections\/([^/]+)\/index$/);
+    if (!indexMatch)
+        return null;
+    if (request.method !== "POST") {
+        return errorResponse(405, "Method not allowed");
+    }
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.includes("multipart/form-data")) {
+        return errorResponse(400, "Expected multipart/form-data");
+    }
+    try {
+        const store = await getVecStore();
+        const collectionName = decodeURIComponent(indexMatch[1]);
+        const collection = await store.getCollection({ name: collectionName });
+        const formData = await request.formData();
+        const file = formData.get("file");
+        if (!file || !(file instanceof File)) {
+            return errorResponse(400, "No file provided");
+        }
+        const text = await file.text();
+        const chunks = splitDocument(text, file.name);
+        if (chunks.length > 0) {
+            await collection.add({
+                ids: chunks.map((_, i) => `${file.name}#${i}`),
+                documents: chunks.map((c) => c.text),
+                metadatas: chunks.map((c) => ({
+                    source: c.source_id,
+                    start_index: String(c.start_index)
+                }))
+            });
+        }
+        return jsonResponse({
+            path: file.name,
+            chunks: chunks.length,
+            error: null
+        });
+    }
+    catch (err) {
+        if (err instanceof VecNotFoundError) {
+            return errorResponse(404, "Collection not found");
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        return errorResponse(500, `Vector store error: ${msg}`);
+    }
+}
+//# sourceMappingURL=collection-api.js.map

package/dist/collection-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection-api.js","sourceRoot":"","sources":["../src/collection-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,EACd,MAAM,0BAA0B,CAAC;AAGlC,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc;IACnD,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,QAAgB,EAChB,QAAwB;IAExB,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,UAAU,CAAC,GAAG,CAAC;gBACnB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,CAAC,CAAC,SAAS;oBACnB,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;iBACnC,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,aAAa,CAAC,GAAG,EAAE,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/error-codes.d.ts

@@ -0,0 +1,3 @@
+export { ApiErrorCode, apiError } from "@nodetool-ai/protocol/api-schemas/api-error-code.js";
+export type { ApiErrorResponse } from "@nodetool-ai/protocol/api-schemas/api-error-code.js";
+//# sourceMappingURL=error-codes.d.ts.map

package/dist/error-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qDAAqD,CAAC;AAC7F,YAAY,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC"}

package/dist/error-codes.js

@@ -0,0 +1,2 @@
+export { ApiErrorCode, apiError } from "@nodetool-ai/protocol/api-schemas/api-error-code.js";
+//# sourceMappingURL=error-codes.js.map

package/dist/error-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qDAAqD,CAAC"}

package/dist/file-api.d.ts

@@ -0,0 +1,12 @@
+export interface FileApiOptions {
+    /** Root directory for the file browser sandbox. Defaults to user home. */
+    rootDir?: string;
+}
+/**
+ * Handle file browser binary download requests.
+ * Route: /api/files/download
+ *
+ * JSON ops (list, info) have moved to the tRPC `files` router.
+ */
+export declare function handleFileRequest(request: Request, options?: FileApiOptions): Promise<Response>;
+//# sourceMappingURL=file-api.d.ts.map

package/dist/file-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-api.d.ts","sourceRoot":"","sources":["../src/file-api.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAmBnB"}

package/dist/file-api.js

@@ -0,0 +1,76 @@
+/**
+ * File browser API — T-WS-9 (binary download only).
+ *
+ * JSON operations (list, info) have been migrated to the tRPC `files` router.
+ * This module retains only the binary download endpoint.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+function errorResponse(status, detail) {
+    return new Response(JSON.stringify({ detail }), {
+        status,
+        headers: { "content-type": "application/json" }
+    });
+}
+/**
+ * Resolve a user-provided path within the sandbox root.
+ * Returns the resolved absolute path, or null if the path escapes the sandbox.
+ */
+function resolveSandboxed(rootDir, userPath) {
+    const resolved = path.resolve(rootDir, userPath.startsWith("/") ? "." + userPath : userPath);
+    const normalizedRoot = path.resolve(rootDir);
+    if (!resolved.startsWith(normalizedRoot + path.sep) &&
+        resolved !== normalizedRoot) {
+        return null;
+    }
+    return resolved;
+}
+async function handleDownload(url, rootDir) {
+    const userPath = url.searchParams.get("path");
+    if (!userPath)
+        return errorResponse(400, "path parameter is required");
+    const resolved = resolveSandboxed(rootDir, userPath);
+    if (!resolved)
+        return errorResponse(403, "Path traversal not allowed");
+    try {
+        const stat = await fs.stat(resolved);
+        if (stat.isDirectory()) {
+            return errorResponse(400, "Cannot download a directory");
+        }
+        const content = await fs.readFile(resolved);
+        return new Response(content, {
+            status: 200,
+            headers: {
+                "content-type": "application/octet-stream",
+                "content-length": String(content.byteLength)
+            }
+        });
+    }
+    catch {
+        return errorResponse(404, "File not found");
+    }
+}
+/**
+ * Handle file browser binary download requests.
+ * Route: /api/files/download
+ *
+ * JSON ops (list, info) have moved to the tRPC `files` router.
+ */
+export async function handleFileRequest(request, options = {}) {
+    // File browser exposes the local filesystem — disabled in production
+    if (process.env["NODETOOL_ENV"] === "production") {
+        return errorResponse(403, "File browser is disabled in production");
+    }
+    if (request.method !== "GET") {
+        return errorResponse(405, "Method not allowed");
+    }
+    const rootDir = options.rootDir ?? os.homedir();
+    const url = new URL(request.url);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (pathname === "/api/files/download") {
+        return handleDownload(url, rootDir);
+    }
+    return errorResponse(404, "Not found");
+}
+//# sourceMappingURL=file-api.js.map

package/dist/file-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-api.js","sourceRoot":"","sources":["../src/file-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAO9B,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc;IACnD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;QAC9C,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,QAAgB;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,OAAO,EACP,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CACrD,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IACE,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/C,QAAQ,KAAK,cAAc,EAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,OAAe;IACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,OAAO,aAAa,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;YAC3B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aAC7C;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,UAA0B,EAAE;IAE5B,qEAAqE;IACrE,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAElD,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QACvC,OAAO,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC"}