@pixelbyte-software/pixcode 1.51.2 → 1.51.4

package/server/modules/orchestration/workspace/docker-workspace.ts

@@ -1,136 +1,136 @@
-import { WorkspaceError } from '@/modules/orchestration/workspace/types.js';
-import type {
-  ExecResult,
-  WorkspaceHandle,
-  WorkspaceRequest,
-} from '@/modules/orchestration/workspace/types.js';
-
-async function run(
-  command: string,
-  args: string[],
-): Promise<ExecResult> {
-  try {
-    const { execFile } = await import('node:child_process');
-    const { promisify } = await import('node:util');
-    const execFileAsync = promisify(execFile);
-    const { stdout, stderr } = await execFileAsync(command, args, {
-      maxBuffer: 20 * 1024 * 1024,
-    });
-    return { stdout: String(stdout), stderr: String(stderr), exitCode: 0 };
-  } catch (error) {
-    const err = error as Error & { stdout?: string; stderr?: string; code?: number };
-    return {
-      stdout: String(err.stdout ?? ''),
-      stderr: String(err.stderr ?? err.message),
-      exitCode: typeof err.code === 'number' ? err.code : 1,
-    };
-  }
-}
-
-export class DockerWorkspace implements WorkspaceHandle {
-  readonly kind = 'docker' as const;
-  readonly id: string;
-  readonly path: string;
-  readonly baseRef: string;
-  readonly metadata: Record<string, unknown>;
-  private containerId?: string;
-  private readonly worktreePath: string;
-
-  constructor(request: WorkspaceRequest) {
-    this.id = `docker_${request.taskId}`;
-    this.path = '/workspace';
-    this.baseRef = request.baseRef ?? 'HEAD';
-    this.worktreePath = request.projectPath;
-    this.metadata = {
-      ...request.metadata,
-      image: request.metadata?.image ?? 'node:22-slim',
-      containerId: undefined,
-      exposedPorts: [],
-    };
-  }
-
-  private async ensureStarted(): Promise<void> {
-    if (this.containerId) return;
-    const image = String(this.metadata.image ?? 'node:22-slim');
-    const pullResult = await run('docker', ['pull', image]);
-    if (pullResult.exitCode !== 0) {
-      throw new WorkspaceError('WORKSPACE_DOCKER_PULL_FAILED', pullResult.stderr || pullResult.stdout, {
-        image,
-        workspaceId: this.id,
-      });
-    }
-    const createResult = await run('docker', [
-      'create',
-      '--rm',
-      '-v', `${this.worktreePath}:/workspace`,
-      '-w', '/workspace',
-      image,
-      'tail', '-f', '/dev/null',
-    ]);
-    if (createResult.exitCode !== 0 || !createResult.stdout.trim()) {
-      throw new WorkspaceError('WORKSPACE_DOCKER_CREATE_FAILED', createResult.stderr || createResult.stdout, {
-        image,
-        workspaceId: this.id,
-      });
-    }
-    this.containerId = createResult.stdout.trim();
-    const startResult = await run('docker', ['start', this.containerId]);
-    if (startResult.exitCode !== 0) {
-      await this.cleanupContainer();
-      throw new WorkspaceError('WORKSPACE_DOCKER_START_FAILED', startResult.stderr || startResult.stdout, {
-        containerId: this.containerId,
-        workspaceId: this.id,
-      });
-    }
-    this.metadata.containerId = this.containerId;
-  }
-
-  private async cleanupContainer(): Promise<void> {
-    if (!this.containerId) return;
-    await run('docker', ['rm', '-f', this.containerId]).catch(() => {});
-    this.containerId = undefined;
-  }
-
-  async exec(command: string, args: string[] = []): Promise<ExecResult> {
-    await this.ensureStarted();
-    return run('docker', ['exec', this.containerId!, command, ...args]);
-  }
-
-  async readFile(relativePath: string): Promise<string> {
-    await this.ensureStarted();
-    const result = await run('docker', ['exec', this.containerId!, 'cat', relativePath]);
-    if (result.exitCode !== 0) {
-      throw new WorkspaceError('WORKSPACE_READ_FAILED', result.stderr, { path: relativePath });
-    }
-    return result.stdout;
-  }
-
-  async writeFile(relativePath: string, content: string): Promise<void> {
-    await this.ensureStarted();
-    const result = await run('docker', ['exec', this.containerId!, 'sh', '-c', `cat > ${relativePath}`]);
-    if (result.exitCode !== 0) {
-      throw new WorkspaceError('WORKSPACE_WRITE_FAILED', result.stderr, { path: relativePath });
-    }
-  }
-
-  async diff(): Promise<string> {
-    const { execFile } = await import('node:child_process');
-    const { promisify } = await import('node:util');
-    const execFileAsync = promisify(execFile);
-    try {
-      const { stdout } = await execFileAsync('git', ['diff', `${this.baseRef}...HEAD`], {
-        cwd: this.worktreePath,
-        maxBuffer: 20 * 1024 * 1024,
-      });
-      return String(stdout);
-    } catch (error) {
-      const err = error as Error & { stderr?: string };
-      const output = String(err.stderr ?? err.message);
-      return /not a git repository|usage: git diff --no-index/i.test(output) ? '' : output;
-    }
-  }
-
-  async destroy(): Promise<void> {
-    await this.cleanupContainer();
-  }
-}
+import { WorkspaceError } from '@/modules/orchestration/workspace/types.js';
+import type {
+  ExecResult,
+  WorkspaceHandle,
+  WorkspaceRequest,
+} from '@/modules/orchestration/workspace/types.js';
+
+async function run(
+  command: string,
+  args: string[],
+): Promise<ExecResult> {
+  try {
+    const { execFile } = await import('node:child_process');
+    const { promisify } = await import('node:util');
+    const execFileAsync = promisify(execFile);
+    const { stdout, stderr } = await execFileAsync(command, args, {
+      maxBuffer: 20 * 1024 * 1024,
+    });
+    return { stdout: String(stdout), stderr: String(stderr), exitCode: 0 };
+  } catch (error) {
+    const err = error as Error & { stdout?: string; stderr?: string; code?: number };
+    return {
+      stdout: String(err.stdout ?? ''),
+      stderr: String(err.stderr ?? err.message),
+      exitCode: typeof err.code === 'number' ? err.code : 1,
+    };
+  }
+}
+
+export class DockerWorkspace implements WorkspaceHandle {
+  readonly kind = 'docker' as const;
+  readonly id: string;
+  readonly path: string;
+  readonly baseRef: string;
+  readonly metadata: Record<string, unknown>;
+  private containerId?: string;
+  private readonly worktreePath: string;
+
+  constructor(request: WorkspaceRequest) {
+    this.id = `docker_${request.taskId}`;
+    this.path = '/workspace';
+    this.baseRef = request.baseRef ?? 'HEAD';
+    this.worktreePath = request.projectPath;
+    this.metadata = {
+      ...request.metadata,
+      image: request.metadata?.image ?? 'node:22-slim',
+      containerId: undefined,
+      exposedPorts: [],
+    };
+  }
+
+  private async ensureStarted(): Promise<void> {
+    if (this.containerId) return;
+    const image = String(this.metadata.image ?? 'node:22-slim');
+    const pullResult = await run('docker', ['pull', image]);
+    if (pullResult.exitCode !== 0) {
+      throw new WorkspaceError('WORKSPACE_DOCKER_PULL_FAILED', pullResult.stderr || pullResult.stdout, {
+        image,
+        workspaceId: this.id,
+      });
+    }
+    const createResult = await run('docker', [
+      'create',
+      '--rm',
+      '-v', `${this.worktreePath}:/workspace`,
+      '-w', '/workspace',
+      image,
+      'tail', '-f', '/dev/null',
+    ]);
+    if (createResult.exitCode !== 0 || !createResult.stdout.trim()) {
+      throw new WorkspaceError('WORKSPACE_DOCKER_CREATE_FAILED', createResult.stderr || createResult.stdout, {
+        image,
+        workspaceId: this.id,
+      });
+    }
+    this.containerId = createResult.stdout.trim();
+    const startResult = await run('docker', ['start', this.containerId]);
+    if (startResult.exitCode !== 0) {
+      await this.cleanupContainer();
+      throw new WorkspaceError('WORKSPACE_DOCKER_START_FAILED', startResult.stderr || startResult.stdout, {
+        containerId: this.containerId,
+        workspaceId: this.id,
+      });
+    }
+    this.metadata.containerId = this.containerId;
+  }
+
+  private async cleanupContainer(): Promise<void> {
+    if (!this.containerId) return;
+    await run('docker', ['rm', '-f', this.containerId]).catch(() => {});
+    this.containerId = undefined;
+  }
+
+  async exec(command: string, args: string[] = []): Promise<ExecResult> {
+    await this.ensureStarted();
+    return run('docker', ['exec', this.containerId!, command, ...args]);
+  }
+
+  async readFile(relativePath: string): Promise<string> {
+    await this.ensureStarted();
+    const result = await run('docker', ['exec', this.containerId!, 'cat', relativePath]);
+    if (result.exitCode !== 0) {
+      throw new WorkspaceError('WORKSPACE_READ_FAILED', result.stderr, { path: relativePath });
+    }
+    return result.stdout;
+  }
+
+  async writeFile(relativePath: string, content: string): Promise<void> {
+    await this.ensureStarted();
+    const result = await run('docker', ['exec', this.containerId!, 'sh', '-c', `cat > ${relativePath}`]);
+    if (result.exitCode !== 0) {
+      throw new WorkspaceError('WORKSPACE_WRITE_FAILED', result.stderr, { path: relativePath });
+    }
+  }
+
+  async diff(): Promise<string> {
+    const { execFile } = await import('node:child_process');
+    const { promisify } = await import('node:util');
+    const execFileAsync = promisify(execFile);
+    try {
+      const { stdout } = await execFileAsync('git', ['diff', `${this.baseRef}...HEAD`], {
+        cwd: this.worktreePath,
+        maxBuffer: 20 * 1024 * 1024,
+      });
+      return String(stdout);
+    } catch (error) {
+      const err = error as Error & { stderr?: string };
+      const output = String(err.stderr ?? err.message);
+      return /not a git repository|usage: git diff --no-index/i.test(output) ? '' : output;
+    }
+  }
+
+  async destroy(): Promise<void> {
+    await this.cleanupContainer();
+  }
+}

package/server/modules/orchestration/workspace/path-safety.ts

@@ -1,55 +1,55 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-import { WorkspaceError } from '@/modules/orchestration/workspace/types.js';
-
-const SAFE_ID = /^[a-zA-Z0-9_-]+$/;
-
-export function getWorktreesRoot(): string {
-  return process.env.PIXCODE_WORKTREES_ROOT ?? path.join(os.homedir(), '.pixcode', 'worktrees');
-}
-
-export function assertSafeId(value: string, label: string): string {
-  if (!SAFE_ID.test(value) || value.includes('..')) {
-    throw new WorkspaceError('UNSAFE_WORKSPACE_ID', `Unsafe ${label}: ${value}`, { value, label });
-  }
-  return value;
-}
-
-export function ensureDirectory(dir: string): void {
-  fs.mkdirSync(dir, { recursive: true });
-}
-
-export function safeWorkspacePath(workspaceId: string): string {
-  assertSafeId(workspaceId, 'workspace id');
-  const root = getWorktreesRoot();
-  ensureDirectory(root);
-  const resolvedRoot = fs.realpathSync.native(root);
-  const target = path.resolve(resolvedRoot, workspaceId);
-  if (!target.startsWith(`${resolvedRoot}${path.sep}`)) {
-    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace path escaped root', {
-      root: resolvedRoot,
-      target,
-    });
-  }
-  return target;
-}
-
-export function safeJoin(root: string, relativePath: string): string {
-  if (path.isAbsolute(relativePath) || relativePath.includes('\0')) {
-    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace file path must be relative', {
-      relativePath,
-    });
-  }
-
-  const target = path.resolve(root, relativePath);
-  const resolvedRoot = fs.existsSync(root) ? fs.realpathSync.native(root) : path.resolve(root);
-  if (!target.startsWith(`${resolvedRoot}${path.sep}`) && target !== resolvedRoot) {
-    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace file path escaped root', {
-      root: resolvedRoot,
-      target,
-    });
-  }
-  return target;
-}
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { WorkspaceError } from '@/modules/orchestration/workspace/types.js';
+
+const SAFE_ID = /^[a-zA-Z0-9_-]+$/;
+
+export function getWorktreesRoot(): string {
+  return process.env.PIXCODE_WORKTREES_ROOT ?? path.join(os.homedir(), '.pixcode', 'worktrees');
+}
+
+export function assertSafeId(value: string, label: string): string {
+  if (!SAFE_ID.test(value) || value.includes('..')) {
+    throw new WorkspaceError('UNSAFE_WORKSPACE_ID', `Unsafe ${label}: ${value}`, { value, label });
+  }
+  return value;
+}
+
+export function ensureDirectory(dir: string): void {
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+export function safeWorkspacePath(workspaceId: string): string {
+  assertSafeId(workspaceId, 'workspace id');
+  const root = getWorktreesRoot();
+  ensureDirectory(root);
+  const resolvedRoot = fs.realpathSync.native(root);
+  const target = path.resolve(resolvedRoot, workspaceId);
+  if (!target.startsWith(`${resolvedRoot}${path.sep}`)) {
+    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace path escaped root', {
+      root: resolvedRoot,
+      target,
+    });
+  }
+  return target;
+}
+
+export function safeJoin(root: string, relativePath: string): string {
+  if (path.isAbsolute(relativePath) || relativePath.includes('\0')) {
+    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace file path must be relative', {
+      relativePath,
+    });
+  }
+
+  const target = path.resolve(root, relativePath);
+  const resolvedRoot = fs.existsSync(root) ? fs.realpathSync.native(root) : path.resolve(root);
+  if (!target.startsWith(`${resolvedRoot}${path.sep}`) && target !== resolvedRoot) {
+    throw new WorkspaceError('WORKSPACE_PATH_TRAVERSAL', 'Workspace file path escaped root', {
+      root: resolvedRoot,
+      target,
+    });
+  }
+  return target;
+}

package/server/modules/orchestration/workspace/types.ts

@@ -1,52 +1,52 @@
-import type { ExecFileOptions } from 'node:child_process';
-
-export type WorkspaceKind = 'host' | 'worktree' | 'docker';
-
-export interface ExecResult {
-  stdout: string;
-  stderr: string;
-  exitCode: number;
-}
-
-export interface WorkspaceHandle {
-  id: string;
-  kind: WorkspaceKind;
-  path: string;
-  baseRef: string;
-  branchName?: string;
-  metadata: Record<string, unknown>;
-  exec(command: string, args?: string[], options?: ExecFileOptions): Promise<ExecResult>;
-  readFile(relativePath: string): Promise<string>;
-  writeFile(relativePath: string, content: string): Promise<void>;
-  diff(): Promise<string>;
-  destroy(): Promise<void>;
-}
-
-export interface WorkspaceRequest {
-  taskId: string;
-  projectPath: string;
-  kind?: WorkspaceKind;
-  baseRef?: string;
-  keepAfterCompletion?: boolean;
-  metadata?: Record<string, unknown>;
-}
-
-export interface WorkspaceMetadata {
-  id: string;
-  kind: WorkspaceKind;
-  path: string;
-  baseRef: string;
-  branchName?: string;
-  keepAfterCompletion?: boolean;
-}
-
-export class WorkspaceError extends Error {
-  constructor(
-    public readonly code: string,
-    message: string,
-    public readonly details: Record<string, unknown> = {},
-  ) {
-    super(message);
-    this.name = 'WorkspaceError';
-  }
-}
+import type { ExecFileOptions } from 'node:child_process';
+
+export type WorkspaceKind = 'host' | 'worktree' | 'docker';
+
+export interface ExecResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number;
+}
+
+export interface WorkspaceHandle {
+  id: string;
+  kind: WorkspaceKind;
+  path: string;
+  baseRef: string;
+  branchName?: string;
+  metadata: Record<string, unknown>;
+  exec(command: string, args?: string[], options?: ExecFileOptions): Promise<ExecResult>;
+  readFile(relativePath: string): Promise<string>;
+  writeFile(relativePath: string, content: string): Promise<void>;
+  diff(): Promise<string>;
+  destroy(): Promise<void>;
+}
+
+export interface WorkspaceRequest {
+  taskId: string;
+  projectPath: string;
+  kind?: WorkspaceKind;
+  baseRef?: string;
+  keepAfterCompletion?: boolean;
+  metadata?: Record<string, unknown>;
+}
+
+export interface WorkspaceMetadata {
+  id: string;
+  kind: WorkspaceKind;
+  path: string;
+  baseRef: string;
+  branchName?: string;
+  keepAfterCompletion?: boolean;
+}
+
+export class WorkspaceError extends Error {
+  constructor(
+    public readonly code: string,
+    message: string,
+    public readonly details: Record<string, unknown> = {},
+  ) {
+    super(message);
+    this.name = 'WorkspaceError';
+  }
+}