@orion-agents/orion-code 0.3.15 → 0.3.18

package/dist/web/server.js

@@ -12,8 +12,70 @@ const errors_1 = require("./errors");
 const cli_options_1 = require("./cli-options");
 const terminal_server_1 = require("./terminal-server");
 const workbench_controller_1 = require("./workbench-controller");
+const native_directory_picker_1 = require("./native-directory-picker");
 const HOST = '127.0.0.1';
 const API_PREFIX = '/api/v1';
+/**
+ * Names that always resolve to this machine.
+ *
+ * The Host check exists to stop DNS rebinding: an attacker who points their own domain at
+ * 127.0.0.1 still sends *their* name in the Host header, and that is what must be refused.
+ * `localhost` is not attacker-controlled — it is resolved from the OS hosts file — so refusing
+ * it only broke the most natural way to open the UI (`http://localhost:4242` returned 421 for
+ * every request, including the document itself). The loopback block is accepted for the same
+ * reason: the whole of 127.0.0.0/8 is this machine.
+ */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '::1', '[::1]']);
+function isLoopbackHostname(hostname) {
+    const value = hostname.toLowerCase();
+    if (LOOPBACK_HOSTNAMES.has(value))
+        return true;
+    const octets = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/u.exec(value);
+    if (!octets)
+        return false;
+    if (octets[1] !== '127')
+        return false;
+    return octets.slice(2).every(part => Number(part) <= 255);
+}
+/** Splits a Host header or an Origin into comparable parts. */
+function parseEndpoint(value) {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value.includes('://') ? value : `http://${value}`);
+        return Object.freeze({
+            protocol: url.protocol,
+            hostname: url.hostname.toLowerCase(),
+            // `new URL` normalises an explicit :80 away, so both sides go through this same path
+            // and stay comparable.
+            port: url.port || '80',
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when `actual` names the same loopback endpoint as the listener's `origin`.
+ *
+ * Shared by the Host and Origin checks on purpose: they used to compare differently, so fixing
+ * one would have left the other still refusing `localhost` — and a mutation refused at the
+ * Origin step looks nothing like a document refused at the Host step.
+ *
+ * The properties that make the check meaningful are preserved: the hostname must be a loopback
+ * name (this is what stops DNS rebinding) and the port and scheme must match the listener.
+ */
+function isSameLoopbackEndpoint(actual, origin) {
+    const expected = parseEndpoint(origin);
+    const candidate = parseEndpoint(actual);
+    if (expected === null || candidate === null)
+        return false;
+    if (candidate.port !== expected.port)
+        return false;
+    if (candidate.protocol !== expected.protocol)
+        return false;
+    return isLoopbackHostname(candidate.hostname);
+}
 async function startOrionWebServer(options) {
     const requestedPort = options.port ?? cli_options_1.DEFAULT_WEB_PORT;
     if (!Number.isSafeInteger(requestedPort) || requestedPort < 0 || requestedPort > 65535) {
@@ -23,7 +85,14 @@ async function startOrionWebServer(options) {
     if (!/^[A-Za-z0-9_-]+$/u.test(nonce)) {
         throw new Error('Web nonce must use unpadded base64url characters.');
     }
-    const workbench = options.workbench ?? (await workbench_controller_1.WebWorkbenchController.create({ cwd: options.cwd }));
+    // v0.3.17 — E2E drives the picker from a script file so CI never opens a real
+    // Finder dialog. Unset in production, which keeps the native adapter.
+    const fixturePicker = (0, native_directory_picker_1.fixturePickerFromEnvironment)();
+    const workbench = options.workbench ??
+        (await workbench_controller_1.WebWorkbenchController.create({
+            cwd: options.cwd,
+            ...(fixturePicker ? { nativeDirectoryPicker: fixturePicker } : {}),
+        }));
     const staticRoot = options.staticRoot ?? resolveDefaultStaticRoot();
     let origin = '';
     let closing;
@@ -185,7 +254,7 @@ async function handleRequest(context) {
         const contextGuard = requireContextGuardRecord(body);
         const workspace = requireText(body.path, 'path', 4096);
         const result = await context.workbench.executeMutation(requestId, 'workspace.activate', { path: workspace, ...contextGuard }, async () => {
-            await context.workbench.switchWorkspace(workspace, contextGuard);
+            await context.workbench.switchWorkspace(workspace, contextGuard, requestId);
             return {
                 requestId,
                 active: context.workbench.workspace,
@@ -195,6 +264,42 @@ async function handleRequest(context) {
         sendJson(response, 200, result);
         return;
     }
+    // v0.3.16 — open the OS directory picker. A browse action: the result is a
+    // path the client must still confirm, so nothing is registered or activated.
+    // v0.3.17 — browse admission: authenticated and single-flight, but NOT a
+    // mutation. It must not raise the global Context mutation admission or enter
+    // the idempotency ledger, otherwise an open Finder dialog looks like a busy
+    // Runtime and a project switch is refused while the user is still browsing.
+    if (method === 'POST' && path === '/workspaces/pick-directory') {
+        assertMutation(request, context.nonce, context.origin);
+        const body = requireRecord(await readJson(request), 'Directory pick request');
+        assertOnlyKeys(body, ['requestId', 'title', 'initialPath']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const title = optionalText(body.title, 'title', 200);
+        const initialPath = optionalText(body.initialPath, 'initialPath', 4096);
+        const picked = await context.workbench.pickDirectory({ title, initialPath, requestId });
+        sendJson(response, 200, {
+            requestId,
+            outcome: picked.kind,
+            ...(picked.kind === 'selected' ? { path: picked.path } : {}),
+            ...(picked.kind === 'unavailable' ? { reason: picked.reason } : {}),
+        });
+        return;
+    }
+    // v0.3.16 — read-only preview of a candidate directory. Authenticated
+    // transport only: no mutation reservation and no idempotency cache, because
+    // this writes nothing and a retry is harmless.
+    if (method === 'POST' && path === '/workspaces/inspect') {
+        assertMutation(request, context.nonce, context.origin);
+        const body = requireRecord(await readJson(request), 'Workspace inspect request');
+        assertOnlyKeys(body, ['requestId', 'path', 'source']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const candidatePath = requireText(body.path, 'path', 4096);
+        const source = requireCandidateSource(optionalText(body.source, 'source', 32));
+        const candidate = await context.workbench.inspectWorkspaceFast(candidatePath, source, requestId);
+        sendJson(response, 200, { requestId, candidate });
+        return;
+    }
     if (method === 'GET' && path === '/sessions') {
         const contextGuard = requireContextGuardQuery(url);
         sendJson(response, 200, collectionPage(url, 'sessions', context.workbench.listSessions(contextGuard), session => session.id));
@@ -423,11 +528,19 @@ async function handleRequest(context) {
     }
     if (method === 'GET' && path === '/git/status') {
         const contextGuard = requireContextGuardQuery(url);
+        const group = url.searchParams.get('group');
+        const searchQuery = url.searchParams.get('query');
         sendJson(response, 200, await context.workbench.gitStatus(contextGuard, {
             ...(url.searchParams.get('cursor')
                 ? { cursor: url.searchParams.get('cursor') }
                 : {}),
             pageSize: boundedInteger(url.searchParams.get('pageSize'), 200, 1, 2000),
+            // v0.3.17 S1 — filtering happens in the Host so result counts cover the whole
+            // matching set. v0.3.17 S4 — the cast is to the *working-tree* source set: a status
+            // query can never filter by the comparison-only `commit` source, and the service
+            // validates the value either way.
+            ...(group ? { group: group } : {}),
+            ...(searchQuery ? { query: searchQuery } : {}),
         }));
         return;
     }
@@ -479,6 +592,174 @@ async function handleRequest(context) {
         sendJson(response, 200, result);
         return;
     }
+    if (method === 'GET' && path === '/git/commit/preview') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitCommitPreview(contextGuard));
+        return;
+    }
+    // v0.3.17 S4 — history reads. All of these are read-only: none of them can touch the
+    // working tree or the index, which is the S4 exit criterion.
+    if (method === 'GET' && path === '/git/refs') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitRefs(contextGuard));
+        return;
+    }
+    if (method === 'GET' && path === '/git/history') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitHistory(contextGuard, {
+            ...optionalQueryParams(url, ['message', 'author', 'sha', 'path', 'since', 'until', 'rev', 'cursor']),
+            pageSize: boundedInteger(url.searchParams.get('pageSize'), 30, 1, 100),
+        }));
+        return;
+    }
+    if (method === 'GET' && path === '/git/compare') {
+        const contextGuard = requireContextGuardQuery(url);
+        const baseRef = url.searchParams.get('base');
+        const headRef = url.searchParams.get('head');
+        const mode = url.searchParams.get('mode') === 'merge-base' ? 'merge-base' : 'snapshot';
+        if (!baseRef || !headRef)
+            throw new HttpProblem(400, 'base and head are required.');
+        sendJson(response, 200, await context.workbench.gitCompare(contextGuard, { baseRef, headRef, mode }));
+        return;
+    }
+    if (method === 'GET' && path === '/git/compare/file') {
+        const contextGuard = requireContextGuardQuery(url);
+        const baseOid = url.searchParams.get('baseOid');
+        const headOid = url.searchParams.get('headOid');
+        const filePath = url.searchParams.get('path');
+        if (!baseOid || !headOid || !filePath) {
+            throw new HttpProblem(400, 'baseOid, headOid and path are required.');
+        }
+        sendJson(response, 200, await context.workbench.gitCompareFileDiff(contextGuard, {
+            baseOid,
+            headOid,
+            path: filePath,
+            ...(url.searchParams.get('cursor')
+                ? { cursor: url.searchParams.get('cursor') }
+                : {}),
+        }));
+        return;
+    }
+    if (method === 'GET' && path === '/git/blame') {
+        const contextGuard = requireContextGuardQuery(url);
+        const filePath = url.searchParams.get('path');
+        if (!filePath)
+            throw new HttpProblem(400, 'path is required.');
+        sendJson(response, 200, await context.workbench.gitBlame(contextGuard, {
+            path: filePath,
+            ...(url.searchParams.get('rev') ? { rev: url.searchParams.get('rev') } : {}),
+            limit: boundedInteger(url.searchParams.get('limit'), 2000, 1, 5000),
+        }));
+        return;
+    }
+    if (method === 'GET' && path === '/git/graph') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitGraph(contextGuard, {
+            limit: boundedInteger(url.searchParams.get('limit'), 200, 1, 2000),
+        }));
+        return;
+    }
+    if (method === 'GET' && path === '/git/files-target') {
+        const contextGuard = requireContextGuardQuery(url);
+        const fileToken = url.searchParams.get('fileToken');
+        if (!fileToken)
+            throw new HttpProblem(400, 'fileToken is required.');
+        sendJson(response, 200, await context.workbench.gitFilesTarget(contextGuard, fileToken));
+        return;
+    }
+    if (method === 'GET' && path === '/git/submodules') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitSubmodules(contextGuard));
+        return;
+    }
+    if (method === 'GET' && path === '/git/conflict') {
+        const contextGuard = requireContextGuardQuery(url);
+        const filePath = url.searchParams.get('path');
+        if (!filePath)
+            throw new HttpProblem(400, 'path is required.');
+        sendJson(response, 200, await context.workbench.gitConflictVersions(contextGuard, filePath));
+        return;
+    }
+    if (method === 'GET' && path === '/git/blob') {
+        const contextGuard = requireContextGuardQuery(url);
+        const filePath = url.searchParams.get('path');
+        const rev = url.searchParams.get('rev');
+        if (!filePath || !rev)
+            throw new HttpProblem(400, 'path and rev are required.');
+        sendJson(response, 200, await context.workbench.gitBlob(contextGuard, { path: filePath, rev }));
+        return;
+    }
+    if (method === 'GET' && path === '/git/file-history') {
+        const contextGuard = requireContextGuardQuery(url);
+        const filePath = url.searchParams.get('path');
+        if (!filePath)
+            throw new HttpProblem(400, 'path is required.');
+        sendJson(response, 200, await context.workbench.gitFileHistory(contextGuard, {
+            path: filePath,
+            ...(url.searchParams.get('rev') ? { rev: url.searchParams.get('rev') } : {}),
+            limit: boundedInteger(url.searchParams.get('limit'), 30, 1, 200),
+        }));
+        return;
+    }
+    if (method === 'GET' && path.startsWith('/git/commit/')) {
+        const contextGuard = requireContextGuardQuery(url);
+        const [, , , rawOid, sub] = path.split('/');
+        const oid = decodeURIComponent(rawOid ?? '');
+        const parentIndex = boundedInteger(url.searchParams.get('parent'), 0, 0, 63);
+        if (sub === 'files') {
+            sendJson(response, 200, await context.workbench.gitCommitFiles(contextGuard, oid, parentIndex));
+            return;
+        }
+        if (sub === 'diff') {
+            const filePath = url.searchParams.get('path');
+            if (!filePath)
+                throw new HttpProblem(400, 'path is required.');
+            sendJson(response, 200, await context.workbench.gitCommitDiff(contextGuard, {
+                oid,
+                path: filePath,
+                parentIndex,
+                ...(url.searchParams.get('cursor')
+                    ? { cursor: url.searchParams.get('cursor') }
+                    : {}),
+            }));
+            return;
+        }
+        sendJson(response, 200, await context.workbench.gitCommitDetail(contextGuard, oid, parentIndex));
+        return;
+    }
+    // v0.3.17 S3 — hunk / line level staging. The body carries ids only; the Host rebuilds the
+    // patch from the reviewed document, so a browser can never submit patch text or Git flags.
+    if (method === 'POST' && path === '/git/patch') {
+        assertMutation(request, context.nonce, context.origin, 'git_mutation_forbidden');
+        assertGitUserGesture(request);
+        const body = requireRecord(await readJson(request), 'Git patch request');
+        assertOnlyKeys(body, [
+            'requestId',
+            'expectedContextRevision',
+            'workspaceId',
+            'fileId',
+            'hunkIds',
+            'lineIds',
+            'expectedRepositoryRevision',
+        ]);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const fileId = requireText(body.fileId, 'fileId', 256);
+        const hunkIds = optionalStringList(body.hunkIds, 'hunkIds', 200, 256);
+        const lineIds = optionalStringList(body.lineIds, 'lineIds', 2000, 256);
+        if (hunkIds.length === 0 && lineIds.length === 0) {
+            throw new errors_1.WebWorkbenchError(400, 'Select at least one hunk or line.', 'git_patch_invalid');
+        }
+        const expectedRepositoryRevision = requireGitRevision(body.expectedRepositoryRevision);
+        const result = await context.workbench.executeMutation(requestId, 'git.patch', { fileId, hunkIds, lineIds, expectedRepositoryRevision, ...contextGuard }, async () => context.workbench.gitApplyPatch(contextGuard, {
+            fileId,
+            hunkIds,
+            lineIds,
+            expectedRepositoryRevision,
+        }));
+        sendJson(response, 200, result);
+        return;
+    }
     if (method === 'POST' && path === '/git/commit') {
         assertMutation(request, context.nonce, context.origin, 'git_mutation_forbidden');
         assertGitUserGesture(request);
@@ -487,14 +768,23 @@ async function handleRequest(context) {
             'requestId',
             'expectedContextRevision',
             'workspaceId',
-            'message',
+            'summary',
+            'body',
             'expectedRepositoryRevision',
         ]);
         const requestId = requireUuid(body.requestId, 'requestId');
         const contextGuard = requireContextGuardRecord(body);
-        const message = requireText(body.message, 'message', 2000);
+        // Newlines are legitimate in a commit body; only control characters are rejected, and
+        // that check lives with the message builder so the two never drift apart.
+        const summary = requireText(body.summary, 'summary', 2000);
+        const commitBody = body.body === undefined ? undefined : requireTextAllowingNewlines(body.body, 'body', 20000);
         const expectedRepositoryRevision = requireGitRevision(body.expectedRepositoryRevision);
-        const result = await context.workbench.executeMutation(requestId, 'git.commit', { message, expectedRepositoryRevision, ...contextGuard }, async () => context.workbench.gitCommit(contextGuard, { message, expectedRepositoryRevision }));
+        const result = await context.workbench.executeMutation(requestId, 'git.commit', { summary, body: commitBody, expectedRepositoryRevision, ...contextGuard }, async () => context.workbench.gitCommit(contextGuard, {
+            summary,
+            ...(commitBody === undefined ? {} : { body: commitBody }),
+            expectedRepositoryRevision,
+            requestId,
+        }));
         sendJson(response, 200, result);
         return;
     }
@@ -508,6 +798,22 @@ async function handleRequest(context) {
         }));
         return;
     }
+    const gitDiffV2Match = path.match(/^\/git\/diff-v2\/([^/]+)$/);
+    if (method === 'GET' && gitDiffV2Match) {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitDiffDocument(contextGuard, {
+            fileId: safeDecodePathSegment(gitDiffV2Match[1]),
+            ...(url.searchParams.get('cursor')
+                ? { cursor: url.searchParams.get('cursor') }
+                : {}),
+            lineLimit: boundedInteger(url.searchParams.get('lineLimit'), 240, 1, 500),
+            byteLimit: boundedInteger(url.searchParams.get('byteLimit'), 256 * 1024, 1024, 1024 * 1024),
+            // v0.3.17 S5 — bound into the pagination cursor by the service.
+            ...(url.searchParams.get('ignoreWhitespace') === '1' ? { ignoreWhitespace: true } : {}),
+            ...(url.searchParams.get('wordDiff') === '1' ? { wordDiff: true } : {}),
+        }));
+        return;
+    }
     const gitDiffMatch = path.match(/^\/git\/diff\/([^/]+)$/);
     if (method === 'GET' && gitDiffMatch) {
         const contextGuard = requireContextGuardQuery(url);
@@ -630,7 +936,7 @@ function openEventStream(request, response, url, workbench) {
     response.once('close', detach);
 }
 function assertMutation(request, nonce, origin, forbiddenCode = 'request_forbidden') {
-    if (request.headers.origin !== origin) {
+    if (!isSameLoopbackEndpoint(request.headers.origin ?? '', origin)) {
         throw new HttpProblem(403, 'Mutation requires the exact loopback Origin.', forbiddenCode);
     }
     const fetchSite = request.headers['sec-fetch-site'];
@@ -685,11 +991,16 @@ function assertTerminalUserGesture(request) {
         throw new HttpProblem(403, 'Terminal creation requires an explicit browser user gesture.', 'terminal_user_gesture_required');
     }
 }
+/**
+ * Rejects any request whose Host is not this machine and this port.
+ *
+ * `evil.invalid` / `attacker.invalid` stay refused (the anti-rebinding property), while
+ * `localhost` and the loopback block are accepted because they name the same listener.
+ */
 function assertHost(request, origin) {
     if (!origin)
         return;
-    const expected = new URL(origin).host;
-    if (request.headers.host !== expected) {
+    if (!isSameLoopbackEndpoint(request.headers.host ?? '', origin)) {
         throw new HttpProblem(421, 'Request Host does not match the loopback listener.');
     }
 }
@@ -831,6 +1142,8 @@ function defaultProblemCode(status) {
             return 'unsupported_media_type';
         case 421:
             return 'misdirected_request';
+        case 429:
+            return 'too_many_requests';
         case 503:
             return 'service_unavailable';
         default:
@@ -843,6 +1156,16 @@ function requireRecord(value, name) {
     }
     return value;
 }
+/** v0.3.17 S4 — copies only the named, non-empty query parameters. */
+function optionalQueryParams(url, names) {
+    const out = {};
+    for (const name of names) {
+        const value = url.searchParams.get(name);
+        if (value !== null && value !== '')
+            out[name] = value;
+    }
+    return out;
+}
 function requireText(value, name, maxLength) {
     if (typeof value !== 'string' || !value.trim()) {
         throw new HttpProblem(400, `${name} must be a non-empty string.`);
@@ -851,6 +1174,57 @@ function requireText(value, name, maxLength) {
         throw new HttpProblem(400, `${name} is too long.`);
     return value.trim();
 }
+function optionalText(value, name, maxLength) {
+    if (value === undefined || value === null)
+        return undefined;
+    return requireText(value, name, maxLength);
+}
+/**
+ * v0.3.17 S3 — commit bodies legitimately span lines, so trimming happens without
+ * rejecting newlines. Control characters are rejected later by `normalizeCommitMessage`,
+ * which is the single owner of that rule.
+ */
+function requireTextAllowingNewlines(value, name, maxLength) {
+    if (typeof value !== 'string') {
+        throw new HttpProblem(400, `${name} must be a string.`);
+    }
+    if (value.length > maxLength)
+        throw new HttpProblem(400, `${name} is too long.`);
+    return value;
+}
+/** v0.3.17 S3 — bounded list of opaque ids; never interpreted as paths or flags. */
+function optionalStringList(value, name, maxItems, maxItemLength) {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value))
+        throw new HttpProblem(400, `${name} must be an array.`);
+    if (value.length > maxItems)
+        throw new HttpProblem(400, `${name} has too many entries.`);
+    const items = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string' || !entry || entry.length > maxItemLength) {
+            throw new HttpProblem(400, `${name} contains an invalid entry.`);
+        }
+        items.push(entry);
+    }
+    return items;
+}
+/** v0.3.16 — where a workspace candidate came from; `manual` is the default. */
+const CANDIDATE_SOURCES = [
+    'picker',
+    'recent',
+    'pinned',
+    'discovered',
+    'manual',
+];
+function requireCandidateSource(value) {
+    if (value === undefined)
+        return 'manual';
+    const source = CANDIDATE_SOURCES.find(candidate => candidate === value);
+    if (!source)
+        throw new HttpProblem(400, 'Unknown workspace candidate source.');
+    return source;
+}
 function requireUuid(value, name) {
     const text = requireText(value, name, 128);
     if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(text)) {
@@ -899,6 +1273,8 @@ function statusTitle(status) {
         return 'Unsupported media type';
     if (status === 421)
         return 'Misdirected request';
+    if (status === 429)
+        return 'Too many requests';
     if (status === 503)
         return 'Service unavailable';
     return 'Internal server error';