@skaile/workspaces 3.25.0 → 3.26.0

package/dist/{chunk-4YRRPWHY.js → chunk-Q6SWQEF7.js}

@@ -1,23 +1,23 @@
-import { buildWorkspaceToolDefs } from './chunk-J4WDQL42.js';
+import { buildWorkspaceToolDefs } from './chunk-KFH5GCDB.js';
 import { findAiAssetsRoot } from './chunk-7IRJ4K4F.js';
-import { WorkspacePlugin } from './chunk-5PFJVZ7F.js';
+import { WorkspacePlugin } from './chunk-ALSDJ6F4.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-T3YLZQS4.js';
-import { resolveFlowPath } from './chunk-UEW6C64M.js';
+import { resolveFlowPath } from './chunk-S3Z5KF6R.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-WMZT7VDS.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-NRKEZBVP.js';
 import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-SIREWRZE.js';
-import { EventNormalizer } from './chunk-NKPDUYRH.js';
+import { EventNormalizer } from './chunk-RPE5VYB6.js';
 import { SUPPORTED_CLOUDS, probeResumeTranscript, CLOUD_SECRET_ENV_KEYS } from './chunk-3NCGSSCU.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { dispatchCapability } from './chunk-HTIGD3DR.js';
+import { dispatchCapability } from './chunk-5SXY4B65.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver } from './chunk-X3DODPMF.js';
+import { createDriver } from './chunk-DGPCBJNQ.js';
 import { loadFlow } from './chunk-W5LPG3X6.js';
 import { parseFlowDefinition } from './chunk-CP62G5PK.js';
 import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
-import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, PROTOCOL_VERSION } from './chunk-V6QKAC3Z.js';
+import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-U2QALNKX.js';
 import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-HSRHO7SK.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
 import { resolveRuntimeAssets } from './chunk-IB4XKQMQ.js';
@@ -30,7 +30,7 @@ import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import fs4, { readFile, stat, rm, unlink, mkdir, writeFile, readdir, rename, realpath, mkdtemp, lstat } from 'fs/promises';
+import fs4, { readFile, stat, rm, unlink, mkdir, writeFile, readdir, realpath, lstat, rename, readlink, mkdtemp } from 'fs/promises';
 import { createHash, randomBytes, timingSafeEqual, randomUUID } from 'crypto';
 import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } from 'path';
 import { existsSync, lstatSync, realpathSync, readFileSync, mkdirSync, writeFileSync, watch, chmodSync, accessSync, constants, rmSync } from 'fs';
@@ -3335,6 +3335,144 @@ async function handleMountResourceRequest(command, manager, emit) {
     });
   }
 }
+var SESSION_ROOT_WRITABLE_FILES = ["skaile.yaml"];
+var SESSION_ROOT_WRITABLE_DIRS = [
+  ".skaile/assets",
+  ".skaile/chat-files"
+];
+function isSessionRootPathAllowed(rel, operation) {
+  if (SESSION_ROOT_WRITABLE_FILES.includes(rel)) return true;
+  return SESSION_ROOT_WRITABLE_DIRS.some(
+    (dir) => rel.startsWith(`${dir}/`) || operation === "delete" && rel === dir
+  );
+}
+function isWithin(root, child) {
+  const rel = relative(root, child);
+  return rel === "" || !(rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel));
+}
+var SESSION_ROOT_MAX_LINK_HOPS = 32;
+async function resolveOnDisk(absPath) {
+  let current = absPath;
+  const missing = [];
+  let hops = 0;
+  for (; ; ) {
+    try {
+      const real = await withFsDeadline(`realpath ${current}`, () => realpath(current));
+      return join(real, ...missing.reverse());
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") throw err;
+      const linkTarget = code === "ENOENT" ? await readDanglingLink(current) : null;
+      if (linkTarget !== null) {
+        if (++hops > SESSION_ROOT_MAX_LINK_HOPS) {
+          throw new Error("Too many symlinks in the session-root path");
+        }
+        const linkDir = dirname(current);
+        const realLinkDir = await withFsDeadline(`realpath ${linkDir}`, () => realpath(linkDir));
+        current = resolve(realLinkDir, linkTarget);
+        continue;
+      }
+      const parent = dirname(current);
+      if (parent === current) throw err;
+      missing.push(basename(current));
+      current = parent;
+    }
+  }
+}
+async function readDanglingLink(absPath) {
+  try {
+    const st = await withFsDeadline(`lstat ${absPath}`, () => lstat(absPath));
+    if (!st.isSymbolicLink()) return null;
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+  return withFsDeadline(`readlink ${absPath}`, () => readlink(absPath));
+}
+async function handleSessionRootResourceRequest(command, rootDir, emit) {
+  const { requestId, connectorId, operation, path: reqPath, content } = command;
+  try {
+    if (operation !== "write" && operation !== "delete") {
+      throw new Error(`Unsupported operation for the session root: ${operation}`);
+    }
+    if (!reqPath) throw new Error("A path is required for the session root");
+    if (isAbsolute(reqPath)) throw new Error("Absolute paths are not allowed for the session root");
+    const root = resolve(rootDir);
+    const targetPath = resolve(root, reqPath);
+    if (!isWithin(root, targetPath)) throw new Error("Path traversal outside the session root");
+    const rel = relative(root, targetPath).split(sep).join("/");
+    if (!isSessionRootPathAllowed(rel, operation)) {
+      throw new Error(
+        `Path "${rel}" is not writable in the session root \u2014 allowed: ${[...SESSION_ROOT_WRITABLE_FILES, ...SESSION_ROOT_WRITABLE_DIRS.map((d) => `${d}/**`)].join(", ")}`
+      );
+    }
+    const realRoot = await withFsDeadline(`realpath ${root}`, () => realpath(root));
+    const onDisk = operation === "write" ? await resolveOnDisk(targetPath) : join(await resolveOnDisk(dirname(targetPath)), basename(targetPath));
+    if (!isWithin(realRoot, operation === "write" ? onDisk : dirname(onDisk))) {
+      throw new Error("Path escapes the session root through a symlink");
+    }
+    let data = true;
+    if (operation === "write") {
+      const parentDir = dirname(onDisk);
+      await withFsDeadline(`mkdir ${parentDir}`, () => mkdir(parentDir, { recursive: true }));
+      const writeContent = typeof content === "string" ? content : content?.data ?? "";
+      const encoding = typeof content === "string" ? void 0 : content?.encoding;
+      await withFsDeadline(
+        `writeFile ${onDisk}`,
+        () => encoding === "binary" ? writeFile(onDisk, Buffer.from(writeContent, "base64")) : writeFile(onDisk, writeContent, "utf-8")
+      );
+    } else {
+      let st = null;
+      try {
+        st = await withFsDeadline(`lstat ${onDisk}`, () => lstat(onDisk));
+      } catch (err) {
+        if (err.code !== "ENOENT") throw err;
+      }
+      if (!st) {
+        data = false;
+      } else if (st.isDirectory()) {
+        await withFsDeadline(
+          `rm -r ${onDisk}`,
+          () => rm(onDisk, { recursive: true, force: true }),
+          fsDeadlineMs() * MOUNT_TREE_OP_DEADLINE_FACTOR
+        );
+      } else {
+        await withFsDeadline(`unlink ${onDisk}`, () => unlink(onDisk));
+      }
+    }
+    emit({ type: "resource_response", requestId, resourceId: connectorId, operation, data });
+  } catch (err) {
+    emit({
+      type: "resource_response",
+      requestId,
+      resourceId: connectorId,
+      operation,
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
+async function dispatchResourceRequest(command, deps) {
+  const { resourceManager, projectDir, emit } = deps;
+  if (command.connectorId === SESSION_ROOT_CONNECTOR_ID) {
+    await handleSessionRootResourceRequest(command, projectDir, emit);
+    return;
+  }
+  if (resourceManager?.has(command.connectorId)) {
+    await handleMountResourceRequest(command, resourceManager, emit);
+    return;
+  }
+  if (!resourceManager) {
+    emit({
+      type: "resource_response",
+      requestId: command.requestId,
+      resourceId: command.connectorId,
+      operation: command.operation,
+      error: "No resources available \u2014 no mounts or connectors configured"
+    });
+    return;
+  }
+  void handleResourceRequest(command, resourceManager, emit);
+}
 
 // runner/src/codex-init.ts
 function validateCodexInit(cmd, supported, previous) {
@@ -5578,7 +5716,7 @@ function buildResourcesAvailablePayload(manager, mcpManager, driverLive, bakedSe
     ...s,
     live: driverLive || (bakedServerIds?.has(s.id) ?? false)
   }));
-  return { type: "resources_available", mounts, connectors, mcp_servers };
+  return { type: "resources_available", mounts, connectors, mcp_servers, sessionRoot: true };
 }
 function isTerminalFlowStatus(status) {
   return status === "complete" || status === "cancelled";
@@ -7943,21 +8081,11 @@ async function startAgentServer(opts) {
   }
   async function handleResourceRequestCommand(cmd) {
     if (!await awaitSessionReadyOrFail()) return;
-    if (resourceManager?.has(cmd.connectorId)) {
-      await handleMountResourceRequest(cmd, resourceManager, sendEvent);
-      return;
-    }
-    if (!resourceManager) {
-      sendEvent({
-        type: "resource_response",
-        requestId: cmd.requestId,
-        resourceId: cmd.connectorId,
-        operation: cmd.operation,
-        error: "No resources available \u2014 no mounts or connectors configured"
-      });
-      return;
-    }
-    void handleResourceRequest(cmd, resourceManager, sendEvent);
+    await dispatchResourceRequest(cmd, {
+      resourceManager,
+      projectDir: opts.projectDir,
+      emit: sendEvent
+    });
   }
   async function handleConnectorMutate(cmd) {
     await executeConnectorMutate(cmd, {
@@ -8482,6 +8610,6 @@ function touchSession(state) {
   return { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-4YRRPWHY.js.map
-//# sourceMappingURL=chunk-4YRRPWHY.js.map
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
+//# sourceMappingURL=chunk-Q6SWQEF7.js.map
+//# sourceMappingURL=chunk-Q6SWQEF7.js.map