@pixelbyte-software/pixcode 1.35.2 → 1.35.3

package/server/modules/orchestration/workflows/workspace-target.ts

@@ -1,120 +1,120 @@
-import { readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-export type WorkspaceTargetKind = 'selected_project' | 'pixcode_app' | 'custom';
-
-export type ResolvedWorkspaceTarget = {
-  kind: WorkspaceTargetKind;
-  label: string;
-  projectPath: string;
-  selectedProjectPath?: string;
-  selectedProjectName?: string;
-  appRoot: string;
-};
-
-const pixcodePackageName = '@pixelbyte-software/pixcode';
-
-function readRecord(value: unknown): Record<string, unknown> | undefined {
-  return value && typeof value === 'object' ? value as Record<string, unknown> : undefined;
-}
-
-function readString(value: unknown): string | undefined {
-  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
-}
-
-function readTargetKind(value: unknown): WorkspaceTargetKind | undefined {
-  return value === 'selected_project' || value === 'pixcode_app' || value === 'custom'
-    ? value
-    : undefined;
-}
-
-export function findPixcodeAppRoot(): string {
-  let currentDir = dirname(fileURLToPath(import.meta.url));
-
-  for (let depth = 0; depth < 10; depth += 1) {
-    try {
-      const packagePath = resolve(currentDir, 'package.json');
-      const pkg = JSON.parse(readFileSync(packagePath, 'utf8')) as { name?: string };
-      if (pkg.name === pixcodePackageName) {
-        return currentDir;
-      }
-    } catch {
-      // Walk upward until the Pixcode package root is found.
-    }
-
-    const parent = dirname(currentDir);
-    if (parent === currentDir) break;
-    currentDir = parent;
-  }
-
-  return process.cwd();
-}
-
-export function resolveWorkflowWorkspace(metadata?: Record<string, unknown>): ResolvedWorkspaceTarget {
-  const target = readRecord(metadata?.workspaceTarget);
-  const appRoot = findPixcodeAppRoot();
-  const selectedProjectPath = readString(metadata?.selectedProjectPath) ?? readString(metadata?.projectPath);
-  const selectedProjectName = readString(metadata?.projectName) ?? readString(metadata?.projectId);
-  const kind = readTargetKind(target?.kind) ?? 'selected_project';
-  const customPath = readString(target?.projectPath);
-
-  if (kind === 'pixcode_app') {
-    return {
-      kind,
-      label: 'Pixcode app',
-      projectPath: appRoot,
-      selectedProjectPath,
-      selectedProjectName,
-      appRoot,
-    };
-  }
-
-  if (kind === 'custom') {
-    return {
-      kind,
-      label: readString(target?.label) ?? 'Custom workspace',
-      projectPath: customPath ?? selectedProjectPath ?? appRoot,
-      selectedProjectPath,
-      selectedProjectName,
-      appRoot,
-    };
-  }
-
-  return {
-    kind: 'selected_project',
-    label: selectedProjectName ?? 'Selected project',
-    projectPath: selectedProjectPath ?? appRoot,
-    selectedProjectPath,
-    selectedProjectName,
-    appRoot,
-  };
-}
-
-export function workspaceTargetMetadata(target: ResolvedWorkspaceTarget): Record<string, unknown> {
-  return {
-    kind: target.kind,
-    label: target.label,
-    projectPath: target.projectPath,
-    selectedProjectPath: target.selectedProjectPath,
-    selectedProjectName: target.selectedProjectName,
-    appRoot: target.appRoot,
-  };
-}
-
-export function workspaceContextPrompt(target: ResolvedWorkspaceTarget): string {
-  return [
-    'Pixcode orchestration execution context:',
-    `- Target workspace: ${target.label}`,
-    `- Working directory for this agent: ${target.projectPath}`,
-    target.selectedProjectName ? `- Selected UI project: ${target.selectedProjectName}` : '',
-    target.selectedProjectPath ? `- Selected UI project path: ${target.selectedProjectPath}` : '',
-    `- Pixcode app root: ${target.appRoot}`,
-    '',
-    'Rules:',
-    '- Treat the working directory above as the authoritative project/application for this task.',
-    '- Do not guess another repository path unless the user explicitly asks for it.',
-    '- If the user asks to analyze or modify Pixcode/orchestration itself, the target workspace must be the Pixcode app root.',
-    '- Before running package-manager commands, inspect the package files in the working directory.',
-  ].filter(Boolean).join('\n');
-}
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export type WorkspaceTargetKind = 'selected_project' | 'pixcode_app' | 'custom';
+
+export type ResolvedWorkspaceTarget = {
+  kind: WorkspaceTargetKind;
+  label: string;
+  projectPath: string;
+  selectedProjectPath?: string;
+  selectedProjectName?: string;
+  appRoot: string;
+};
+
+const pixcodePackageName = '@pixelbyte-software/pixcode';
+
+function readRecord(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === 'object' ? value as Record<string, unknown> : undefined;
+}
+
+function readString(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+function readTargetKind(value: unknown): WorkspaceTargetKind | undefined {
+  return value === 'selected_project' || value === 'pixcode_app' || value === 'custom'
+    ? value
+    : undefined;
+}
+
+export function findPixcodeAppRoot(): string {
+  let currentDir = dirname(fileURLToPath(import.meta.url));
+
+  for (let depth = 0; depth < 10; depth += 1) {
+    try {
+      const packagePath = resolve(currentDir, 'package.json');
+      const pkg = JSON.parse(readFileSync(packagePath, 'utf8')) as { name?: string };
+      if (pkg.name === pixcodePackageName) {
+        return currentDir;
+      }
+    } catch {
+      // Walk upward until the Pixcode package root is found.
+    }
+
+    const parent = dirname(currentDir);
+    if (parent === currentDir) break;
+    currentDir = parent;
+  }
+
+  return process.cwd();
+}
+
+export function resolveWorkflowWorkspace(metadata?: Record<string, unknown>): ResolvedWorkspaceTarget {
+  const target = readRecord(metadata?.workspaceTarget);
+  const appRoot = findPixcodeAppRoot();
+  const selectedProjectPath = readString(metadata?.selectedProjectPath) ?? readString(metadata?.projectPath);
+  const selectedProjectName = readString(metadata?.projectName) ?? readString(metadata?.projectId);
+  const kind = readTargetKind(target?.kind) ?? 'selected_project';
+  const customPath = readString(target?.projectPath);
+
+  if (kind === 'pixcode_app') {
+    return {
+      kind,
+      label: 'Pixcode app',
+      projectPath: appRoot,
+      selectedProjectPath,
+      selectedProjectName,
+      appRoot,
+    };
+  }
+
+  if (kind === 'custom') {
+    return {
+      kind,
+      label: readString(target?.label) ?? 'Custom workspace',
+      projectPath: customPath ?? selectedProjectPath ?? appRoot,
+      selectedProjectPath,
+      selectedProjectName,
+      appRoot,
+    };
+  }
+
+  return {
+    kind: 'selected_project',
+    label: selectedProjectName ?? 'Selected project',
+    projectPath: selectedProjectPath ?? appRoot,
+    selectedProjectPath,
+    selectedProjectName,
+    appRoot,
+  };
+}
+
+export function workspaceTargetMetadata(target: ResolvedWorkspaceTarget): Record<string, unknown> {
+  return {
+    kind: target.kind,
+    label: target.label,
+    projectPath: target.projectPath,
+    selectedProjectPath: target.selectedProjectPath,
+    selectedProjectName: target.selectedProjectName,
+    appRoot: target.appRoot,
+  };
+}
+
+export function workspaceContextPrompt(target: ResolvedWorkspaceTarget): string {
+  return [
+    'Pixcode orchestration execution context:',
+    `- Target workspace: ${target.label}`,
+    `- Working directory for this agent: ${target.projectPath}`,
+    target.selectedProjectName ? `- Selected UI project: ${target.selectedProjectName}` : '',
+    target.selectedProjectPath ? `- Selected UI project path: ${target.selectedProjectPath}` : '',
+    `- Pixcode app root: ${target.appRoot}`,
+    '',
+    'Rules:',
+    '- Treat the working directory above as the authoritative project/application for this task.',
+    '- Do not guess another repository path unless the user explicitly asks for it.',
+    '- If the user asks to analyze or modify Pixcode/orchestration itself, the target workspace must be the Pixcode app root.',
+    '- Before running package-manager commands, inspect the package files in the working directory.',
+  ].filter(Boolean).join('\n');
+}

package/server/modules/orchestration/workspace/docker-workspace.ts

@@ -1,135 +1,135 @@
-import { WorkspaceError } from '@/modules/orchestration/workspace/types.js';
-import type {
-  ExecResult,
-  WorkspaceHandle,
-  WorkspaceRequest,
-} from '@/modules/orchestration/workspace/types.js';
-
-async function run(
-  command: string,
-  args: string[],
-): Promise<ExecResult> {
-  try {
-    const { execFile } = await import('node:child_process');
-    const { promisify } = await import('node:util');
-    const execFileAsync = promisify(execFile);
-    const { stdout, stderr } = await execFileAsync(command, args, {
-      maxBuffer: 20 * 1024 * 1024,
-    });
-    return { stdout: String(stdout), stderr: String(stderr), exitCode: 0 };
-  } catch (error) {
-    const err = error as Error & { stdout?: string; stderr?: string; code?: number };
-    return {
-      stdout: String(err.stdout ?? ''),
-      stderr: String(err.stderr ?? err.message),
-      exitCode: typeof err.code === 'number' ? err.code : 1,
-    };
-  }
-}
-
-export class DockerWorkspace implements WorkspaceHandle {
-  readonly kind = 'docker' as const;
-  readonly id: string;
-  readonly path: string;
-  readonly baseRef: string;
-  readonly metadata: Record<string, unknown>;
-  private containerId?: string;
-  private readonly worktreePath: string;
-
-  constructor(request: WorkspaceRequest) {
-    this.id = `docker_${request.taskId}`;
-    this.path = '/workspace';
-    this.baseRef = request.baseRef ?? 'HEAD';
-    this.worktreePath = request.projectPath;
-    this.metadata = {
-      ...request.metadata,
-      image: request.metadata?.image ?? 'node:22-slim',
-      containerId: undefined,
-      exposedPorts: [],
-    };
-  }
-
-  private async ensureStarted(): Promise<void> {
-    if (this.containerId) return;
-    const image = String(this.metadata.image ?? 'node:22-slim');
-    const pullResult = await run('docker', ['pull', image]);
-    if (pullResult.exitCode !== 0) {
-      throw new WorkspaceError('WORKSPACE_DOCKER_PULL_FAILED', pullResult.stderr || pullResult.stdout, {
-        image,
-        workspaceId: this.id,
-      });
-    }
-    const createResult = await run('docker', [
-      'create',
-      '--rm',
-      '-v', `${this.worktreePath}:/workspace`,
-      '-w', '/workspace',
-      image,
-      'tail', '-f', '/dev/null',
-    ]);
-    if (createResult.exitCode !== 0 || !createResult.stdout.trim()) {
-      throw new WorkspaceError('WORKSPACE_DOCKER_CREATE_FAILED', createResult.stderr || createResult.stdout, {
-        image,
-        workspaceId: this.id,
-      });
-    }
-    this.containerId = createResult.stdout.trim();
-    const startResult = await run('docker', ['start', this.containerId]);
-    if (startResult.exitCode !== 0) {
-      await this.cleanupContainer();
-      throw new WorkspaceError('WORKSPACE_DOCKER_START_FAILED', startResult.stderr || startResult.stdout, {
-        containerId: this.containerId,
-        workspaceId: this.id,
-      });
-    }
-    this.metadata.containerId = this.containerId;
-  }
-
-  private async cleanupContainer(): Promise<void> {
-    if (!this.containerId) return;
-    await run('docker', ['rm', '-f', this.containerId]).catch(() => {});
-    this.containerId = undefined;
-  }
-
-  async exec(command: string, args: string[] = []): Promise<ExecResult> {
-    await this.ensureStarted();
-    return run('docker', ['exec', this.containerId!, command, ...args]);
-  }
-
-  async readFile(relativePath: string): Promise<string> {
-    await this.ensureStarted();
-    const result = await run('docker', ['exec', this.containerId!, 'cat', relativePath]);
-    if (result.exitCode !== 0) {
-      throw new WorkspaceError('WORKSPACE_READ_FAILED', result.stderr, { path: relativePath });
-    }
-    return result.stdout;
-  }
-
-  async writeFile(relativePath: string, content: string): Promise<void> {
-    await this.ensureStarted();
-    const result = await run('docker', ['exec', this.containerId!, 'sh', '-c', `cat > ${relativePath}`]);
-    if (result.exitCode !== 0) {
-      throw new WorkspaceError('WORKSPACE_WRITE_FAILED', result.stderr, { path: relativePath });
-    }
-  }
-
-  async diff(): Promise<string> {
-    const { execFile } = await import('node:child_process');
-    const { promisify } = await import('node:util');
-    const execFileAsync = promisify(execFile);
-    try {
-      const { stdout } = await execFileAsync('git', ['diff', `${this.baseRef}...HEAD`], {
-        cwd: this.worktreePath,
-        maxBuffer: 20 * 1024 * 1024,
-      });
-      return String(stdout);
-    } catch (error) {
-      const err = error as Error & { stderr?: string };
-      return String(err.stderr ?? err.message);
-    }
-  }
-
-  async destroy(): Promise<void> {
-    await this.cleanupContainer();
-  }
-}
+import { WorkspaceError } from '@/modules/orchestration/workspace/types.js';
+import type {
+  ExecResult,
+  WorkspaceHandle,
+  WorkspaceRequest,
+} from '@/modules/orchestration/workspace/types.js';
+
+async function run(
+  command: string,
+  args: string[],
+): Promise<ExecResult> {
+  try {
+    const { execFile } = await import('node:child_process');
+    const { promisify } = await import('node:util');
+    const execFileAsync = promisify(execFile);
+    const { stdout, stderr } = await execFileAsync(command, args, {
+      maxBuffer: 20 * 1024 * 1024,
+    });
+    return { stdout: String(stdout), stderr: String(stderr), exitCode: 0 };
+  } catch (error) {
+    const err = error as Error & { stdout?: string; stderr?: string; code?: number };
+    return {
+      stdout: String(err.stdout ?? ''),
+      stderr: String(err.stderr ?? err.message),
+      exitCode: typeof err.code === 'number' ? err.code : 1,
+    };
+  }
+}
+
+export class DockerWorkspace implements WorkspaceHandle {
+  readonly kind = 'docker' as const;
+  readonly id: string;
+  readonly path: string;
+  readonly baseRef: string;
+  readonly metadata: Record<string, unknown>;
+  private containerId?: string;
+  private readonly worktreePath: string;
+
+  constructor(request: WorkspaceRequest) {
+    this.id = `docker_${request.taskId}`;
+    this.path = '/workspace';
+    this.baseRef = request.baseRef ?? 'HEAD';
+    this.worktreePath = request.projectPath;
+    this.metadata = {
+      ...request.metadata,
+      image: request.metadata?.image ?? 'node:22-slim',
+      containerId: undefined,
+      exposedPorts: [],
+    };
+  }
+
+  private async ensureStarted(): Promise<void> {
+    if (this.containerId) return;
+    const image = String(this.metadata.image ?? 'node:22-slim');
+    const pullResult = await run('docker', ['pull', image]);
+    if (pullResult.exitCode !== 0) {
+      throw new WorkspaceError('WORKSPACE_DOCKER_PULL_FAILED', pullResult.stderr || pullResult.stdout, {
+        image,
+        workspaceId: this.id,
+      });
+    }
+    const createResult = await run('docker', [
+      'create',
+      '--rm',
+      '-v', `${this.worktreePath}:/workspace`,
+      '-w', '/workspace',
+      image,
+      'tail', '-f', '/dev/null',
+    ]);
+    if (createResult.exitCode !== 0 || !createResult.stdout.trim()) {
+      throw new WorkspaceError('WORKSPACE_DOCKER_CREATE_FAILED', createResult.stderr || createResult.stdout, {
+        image,
+        workspaceId: this.id,
+      });
+    }
+    this.containerId = createResult.stdout.trim();
+    const startResult = await run('docker', ['start', this.containerId]);
+    if (startResult.exitCode !== 0) {
+      await this.cleanupContainer();
+      throw new WorkspaceError('WORKSPACE_DOCKER_START_FAILED', startResult.stderr || startResult.stdout, {
+        containerId: this.containerId,
+        workspaceId: this.id,
+      });
+    }
+    this.metadata.containerId = this.containerId;
+  }
+
+  private async cleanupContainer(): Promise<void> {
+    if (!this.containerId) return;
+    await run('docker', ['rm', '-f', this.containerId]).catch(() => {});
+    this.containerId = undefined;
+  }
+
+  async exec(command: string, args: string[] = []): Promise<ExecResult> {
+    await this.ensureStarted();
+    return run('docker', ['exec', this.containerId!, command, ...args]);
+  }
+
+  async readFile(relativePath: string): Promise<string> {
+    await this.ensureStarted();
+    const result = await run('docker', ['exec', this.containerId!, 'cat', relativePath]);
+    if (result.exitCode !== 0) {
+      throw new WorkspaceError('WORKSPACE_READ_FAILED', result.stderr, { path: relativePath });
+    }
+    return result.stdout;
+  }
+
+  async writeFile(relativePath: string, content: string): Promise<void> {
+    await this.ensureStarted();
+    const result = await run('docker', ['exec', this.containerId!, 'sh', '-c', `cat > ${relativePath}`]);
+    if (result.exitCode !== 0) {
+      throw new WorkspaceError('WORKSPACE_WRITE_FAILED', result.stderr, { path: relativePath });
+    }
+  }
+
+  async diff(): Promise<string> {
+    const { execFile } = await import('node:child_process');
+    const { promisify } = await import('node:util');
+    const execFileAsync = promisify(execFile);
+    try {
+      const { stdout } = await execFileAsync('git', ['diff', `${this.baseRef}...HEAD`], {
+        cwd: this.worktreePath,
+        maxBuffer: 20 * 1024 * 1024,
+      });
+      return String(stdout);
+    } catch (error) {
+      const err = error as Error & { stderr?: string };
+      return String(err.stderr ?? err.message);
+    }
+  }
+
+  async destroy(): Promise<void> {
+    await this.cleanupContainer();
+  }
+}

package/server/modules/orchestration/workspace/path-safety.ts

@@ -1,55 +1,55 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-import { WorkspaceError } from '@/modules/orchestration/workspace/types.js';
-
-const SAFE_ID = /^[a-zA-Z0-9_-]+$/;
-
-export function getWorktreesRoot(): string {
-  return process.env.PIXCODE_WORKTREES_ROOT ?? path.join(os.homedir(), '.pixcode', 'worktrees');
-}
-
-export function assertSafeId(value: string, label: string): string {
-  if (!SAFE_ID.test(value) || value.includes('..')) {
-    throw new WorkspaceError('UNSAFE_WORKSPACE_ID', `Unsafe ${label}: ${value}`, { value, label });
-  }
-  return value;
-}
-
-export function ensureDirectory(dir: string): void {
-  fs.mkdirSync(dir, { recursive: true });
-}
-
-export function safeWorkspacePath(workspaceId: string): string {
-  assertSafeId(workspaceId, 'workspace id');
-  const root = getWorktreesRoot();
-  ensureDirectory(root);
-  const resolvedRoot = fs.realpathSync.native(root);
-  const target = path.resolve(resolvedRoot, workspaceId);
-  if (!target.startsWith(`${resolvedRoot}${path.sep}`)) {
-    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace path escaped root', {
-      root: resolvedRoot,
-      target,
-    });
-  }
-  return target;
-}
-
-export function safeJoin(root: string, relativePath: string): string {
-  if (path.isAbsolute(relativePath) || relativePath.includes('\0')) {
-    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace file path must be relative', {
-      relativePath,
-    });
-  }
-
-  const target = path.resolve(root, relativePath);
-  const resolvedRoot = fs.existsSync(root) ? fs.realpathSync.native(root) : path.resolve(root);
-  if (!target.startsWith(`${resolvedRoot}${path.sep}`) && target !== resolvedRoot) {
-    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace file path escaped root', {
-      root: resolvedRoot,
-      target,
-    });
-  }
-  return target;
-}
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { WorkspaceError } from '@/modules/orchestration/workspace/types.js';
+
+const SAFE_ID = /^[a-zA-Z0-9_-]+$/;
+
+export function getWorktreesRoot(): string {
+  return process.env.PIXCODE_WORKTREES_ROOT ?? path.join(os.homedir(), '.pixcode', 'worktrees');
+}
+
+export function assertSafeId(value: string, label: string): string {
+  if (!SAFE_ID.test(value) || value.includes('..')) {
+    throw new WorkspaceError('UNSAFE_WORKSPACE_ID', `Unsafe ${label}: ${value}`, { value, label });
+  }
+  return value;
+}
+
+export function ensureDirectory(dir: string): void {
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+export function safeWorkspacePath(workspaceId: string): string {
+  assertSafeId(workspaceId, 'workspace id');
+  const root = getWorktreesRoot();
+  ensureDirectory(root);
+  const resolvedRoot = fs.realpathSync.native(root);
+  const target = path.resolve(resolvedRoot, workspaceId);
+  if (!target.startsWith(`${resolvedRoot}${path.sep}`)) {
+    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace path escaped root', {
+      root: resolvedRoot,
+      target,
+    });
+  }
+  return target;
+}
+
+export function safeJoin(root: string, relativePath: string): string {
+  if (path.isAbsolute(relativePath) || relativePath.includes('\0')) {
+    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace file path must be relative', {
+      relativePath,
+    });
+  }
+
+  const target = path.resolve(root, relativePath);
+  const resolvedRoot = fs.existsSync(root) ? fs.realpathSync.native(root) : path.resolve(root);
+  if (!target.startsWith(`${resolvedRoot}${path.sep}`) && target !== resolvedRoot) {
+    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace file path escaped root', {
+      root: resolvedRoot,
+      target,
+    });
+  }
+  return target;
+}