@vincenthanxiaodu/pi-web 1.202608.1

package/dist/server/workspaces/fileContentService.js

@@ -0,0 +1,190 @@
+import { lstat, mkdir, open, realpath, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { classifyWorkspaceFile, MAX_WORKSPACE_FILE_CONTENT_BYTES } from "../../shared/workspaceFiles.js";
+import { resolveWorkspacePathAccessTarget } from "./pathAccessPolicy.js";
+import { ensureInside, isNodeErrorWithCode, resolveInsideWorkspace, resolveParentInsideWorkspace } from "./pathSafety.js";
+export async function readWorkspaceFile(rootPath, path, pathAccess) {
+    if (path === undefined || path === "")
+        throw new Error("path query parameter is required");
+    const { target, displayPath } = await resolveWorkspacePathAccessTarget(rootPath, path, pathAccess);
+    const s = await stat(target);
+    if (!s.isFile())
+        throw new Error("Path is not a file");
+    const bytesToRead = Math.min(s.size, MAX_WORKSPACE_FILE_CONTENT_BYTES);
+    const buffer = await readFilePrefix(target, bytesToRead);
+    const classification = classifyWorkspaceFile(displayPath);
+    const media = mediaForClassification(classification);
+    // Text-source formats (HTML, Markdown, SVG) retain capped literal UTF-8
+    // source for Raw mode. Raster image and PDF bytes stay out of JSON and are
+    // served only by the preview response.
+    const binary = classification?.source === "stream" || (classification === undefined && isProbablyBinary(buffer));
+    return {
+        path: displayPath,
+        ...languageForPath(displayPath),
+        ...media,
+        encoding: "utf8",
+        size: s.size,
+        modifiedAt: s.mtime.toISOString(),
+        content: binary ? "" : buffer.toString("utf8"),
+        truncated: s.size > MAX_WORKSPACE_FILE_CONTENT_BYTES,
+        binary,
+    };
+}
+async function readFilePrefix(target, bytesToRead) {
+    if (bytesToRead === 0)
+        return Buffer.alloc(0);
+    const buffer = Buffer.alloc(bytesToRead);
+    const handle = await open(target, "r");
+    try {
+        const result = await handle.read(buffer, 0, bytesToRead, 0);
+        return buffer.subarray(0, result.bytesRead);
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function writeWorkspaceFile(rootPath, path, content, options = {}) {
+    if (path === undefined || path === "")
+        throw new Error("path query parameter is required");
+    const createDirs = options.createDirs ?? true;
+    const overwrite = options.overwrite ?? true;
+    let exists = false;
+    try {
+        const { target, relativePath } = await resolveInsideWorkspace(rootPath, path);
+        const s = await stat(target);
+        if (!s.isFile())
+            throw new Error("Path is not a file");
+        if (!overwrite)
+            throw new Error(`File already exists: ${relativePath}`);
+        exists = true;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("File already exists"))
+            throw error;
+        if (isNodeErrorWithCode(error, "ENOENT")) { /* expected for creation — continue */ }
+        else if (error instanceof Error && error.message === "Path does not exist") { /* expected for creation — continue */ }
+        else
+            throw error; // re-throw permission errors, "not a file", traversal errors, etc.
+    }
+    // Use resolveParentInsideWorkspace for the actual write since the target may not exist yet
+    const { root, target, relativePath } = await resolveParentInsideWorkspace(rootPath, path);
+    if (createDirs)
+        await mkdir(dirname(target), { recursive: true });
+    // Resolve symlinks in the parent path to prevent escape via symlink
+    const realParent = await realpath(dirname(target));
+    const realTarget = join(realParent, basename(target));
+    ensureInside(root, realTarget);
+    await writeFile(realTarget, content);
+    const s = await stat(realTarget);
+    return {
+        path: relativePath,
+        size: s.size,
+        modifiedAt: s.mtime.toISOString(),
+        created: !exists,
+    };
+}
+export async function deleteWorkspaceFile(rootPath, path) {
+    if (path === undefined || path === "")
+        throw new Error("path query parameter is required");
+    // Use resolveParentInsideWorkspace + lstat so that deleting a symlink
+    // deletes the symlink itself, not the target it points to.
+    // resolveInsideWorkspace would call realpath on the target, following
+    // symlinks and resolving the symlink's destination instead.
+    const { root, target, relativePath } = await resolveParentInsideWorkspace(rootPath, path);
+    try {
+        // Resolve symlinks in the parent path to prevent escape via a symlinked
+        // parent directory. The final path component is intentionally NOT resolved
+        // so that lstat/unlink act on the entry itself (deleting a symlink rather
+        // than the file it points to).
+        const realParent = await realpath(dirname(target));
+        const realTarget = join(realParent, basename(target));
+        ensureInside(root, realTarget);
+        const s = await lstat(realTarget);
+        // Allow deleting regular files and symlinks, but not directories
+        if (s.isDirectory())
+            throw new Error("Path is a directory, use directory deletion instead");
+        await unlink(realTarget);
+        return { path: relativePath, existed: true };
+    }
+    catch (error) {
+        if (isNodeErrorWithCode(error, "ENOENT"))
+            return { path: relativePath, existed: false };
+        if (error instanceof Error && error.message === "Path does not exist")
+            return { path: relativePath, existed: false };
+        throw error;
+    }
+}
+export async function moveWorkspaceFile(rootPath, fromPath, toPath, options = {}) {
+    if (fromPath === undefined || fromPath === "")
+        throw new Error("fromPath query parameter is required");
+    if (toPath === undefined || toPath === "")
+        throw new Error("toPath query parameter is required");
+    const createDirs = options.createDirs ?? true;
+    const overwrite = options.overwrite ?? false;
+    // Source: must exist and be a file (uses realpath via resolveInsideWorkspace)
+    const { target: source, relativePath: fromRelative } = await resolveInsideWorkspace(rootPath, fromPath);
+    const sourceStat = await stat(source);
+    if (!sourceStat.isFile())
+        throw new Error("Source path is not a file");
+    // Target: uses resolveParentInsideWorkspace + realpath(dirname) pattern (same as writeFile)
+    const { root, target: dest, relativePath: destRelative } = await resolveParentInsideWorkspace(rootPath, toPath);
+    if (createDirs)
+        await mkdir(dirname(dest), { recursive: true });
+    // Resolve symlinks in the parent path to prevent escape via symlink
+    const realParent = await realpath(dirname(dest));
+    const realDest = join(realParent, basename(dest));
+    ensureInside(root, realDest);
+    if (!overwrite) {
+        try {
+            const destStat = await stat(realDest);
+            if (destStat.isFile())
+                throw new Error(`File already exists: ${destRelative}`);
+        }
+        catch (error) {
+            if (isNodeErrorWithCode(error, "ENOENT")) { /* expected — target doesn't exist */ }
+            else if (error instanceof Error && error.message.startsWith("File already exists"))
+                throw error;
+            else
+                throw error;
+        }
+    }
+    await rename(source, realDest);
+    const finalStat = await stat(realDest);
+    return { fromPath: fromRelative, toPath: destRelative, size: finalStat.size, modifiedAt: finalStat.mtime.toISOString() };
+}
+function isProbablyBinary(buffer) {
+    const sample = buffer.subarray(0, Math.min(buffer.length, 8192));
+    return sample.includes(0);
+}
+function languageForPath(path) {
+    const ext = path.split(".").pop()?.toLowerCase();
+    const languages = {
+        ts: "typescript",
+        tsx: "typescript",
+        js: "javascript",
+        jsx: "javascript",
+        json: "json",
+        md: "markdown",
+        markdown: "markdown",
+        css: "css",
+        htm: "html",
+        html: "html",
+        py: "python",
+        rs: "rust",
+        go: "go",
+        sh: "shell",
+        yml: "yaml",
+        yaml: "yaml",
+    };
+    const language = ext === undefined ? undefined : languages[ext];
+    return language === undefined ? {} : { language };
+}
+function mediaForClassification(classification) {
+    if (classification === undefined)
+        return {};
+    return {
+        mediaType: classification.mediaType,
+        ...("previewMimeType" in classification ? { mimeType: classification.previewMimeType } : {}),
+    };
+}
+//# sourceMappingURL=fileContentService.js.map

package/dist/server/workspaces/fileContentService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileContentService.js","sourceRoot":"","sources":["../../../src/server/workspaces/fileContentService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAoC,MAAM,gCAAgC,CAAC;AAC3I,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAE1H,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,IAAwB,EAAE,UAAkC;IACpH,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3F,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,gCAAgC,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACnG,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACrD,wEAAwE;IACxE,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,MAAM,GAAG,cAAc,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjH,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,GAAG,eAAe,CAAC,WAAW,CAAC;QAC/B,GAAG,KAAK;QACR,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,SAAS,EAAE,CAAC,CAAC,IAAI,GAAG,gCAAgC;QACpD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,WAAmB;IAC/D,IAAI,WAAW,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,IAAwB,EAAE,OAAe,EAAE,UAAqC,EAAE;IAC3I,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAE3F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAE5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;QACxE,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3F,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,sCAAsC,CAAC,CAAC;aAC/E,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC,CAAC,sCAAsC,CAAC,CAAC;;YACjH,MAAM,KAAK,CAAC,CAAC,mEAAmE;IACvF,CAAC;IAED,2FAA2F;IAC3F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE1F,IAAI,UAAU;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElE,oEAAoE;IACpE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC/B,MAAM,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAErC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QACjC,OAAO,EAAE,CAAC,MAAM;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,IAAwB;IAClF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3F,sEAAsE;IACtE,2DAA2D;IAC3D,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1F,IAAI,CAAC;QACH,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,iEAAiE;QACjE,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxF,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,qBAAqB;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAA4B,EAAE,MAA0B,EAAE,UAAoC,EAAE;IACxJ,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvG,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAEjG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE7C,8EAA8E;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAEvE,4FAA4F;IAC5F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEhH,IAAI,UAAU;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhE,oEAAoE;IACpE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE7B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,qCAAqC,CAAC,CAAC;iBAC9E,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC;gBAAE,MAAM,KAAK,CAAC;;gBAC3F,MAAM,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3H,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IACjD,MAAM,SAAS,GAAuC;QACpD,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,YAAY;QACjB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,UAAU;QACd,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,QAAQ;QACZ,EAAE,EAAE,MAAM;QACV,EAAE,EAAE,IAAI;QACR,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,MAAM;KACb,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,sBAAsB,CAAC,cAAuD;IACrF,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,GAAG,CAAC,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAC;AACJ,CAAC"}

package/dist/server/workspaces/filePreviewResponseHeaders.js

@@ -0,0 +1,18 @@
+import { workspaceFilePreviewErrorResponsePolicy } from "./filePreviewResponsePolicy.js";
+/** Writes a preview response policy onto a reply, so local and proxied previews emit the identical contract. */
+export function applyWorkspaceFilePreviewResponsePolicy(reply, policy) {
+    return reply
+        .header("Content-Type", policy.contentType)
+        .header("Content-Disposition", policy.contentDisposition)
+        .header("Content-Security-Policy", policy.contentSecurityPolicy)
+        .header("X-Content-Type-Options", policy.contentTypeOptions);
+}
+/**
+ * Hardens a failed preview response. Preview URLs are navigated directly by the
+ * browser, so an error body carrying attacker-influenced path text must never be
+ * sniffable into active content, on either the local or the remote route.
+ */
+export function applyWorkspaceFilePreviewErrorResponsePolicy(reply) {
+    return applyWorkspaceFilePreviewResponsePolicy(reply, workspaceFilePreviewErrorResponsePolicy());
+}
+//# sourceMappingURL=filePreviewResponseHeaders.js.map

package/dist/server/workspaces/filePreviewResponseHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filePreviewResponseHeaders.js","sourceRoot":"","sources":["../../../src/server/workspaces/filePreviewResponseHeaders.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uCAAuC,EAA2C,MAAM,gCAAgC,CAAC;AAElI,gHAAgH;AAChH,MAAM,UAAU,uCAAuC,CAAC,KAAmB,EAAE,MAA0C;IACrH,OAAO,KAAK;SACT,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC;SAC1C,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,CAAC;SACxD,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAAC,qBAAqB,CAAC;SAC/D,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4CAA4C,CAAC,KAAmB;IAC9E,OAAO,uCAAuC,CAAC,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;AACnG,CAAC"}

package/dist/server/workspaces/filePreviewResponsePolicy.js

@@ -0,0 +1,55 @@
+import { classifyWorkspaceFile, workspaceFileName } from "../../shared/workspaceFiles.js";
+const IMAGE_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'; object-src 'none'; script-src 'none'; connect-src 'none'; img-src data: blob:; media-src 'none'; font-src 'none'; style-src 'unsafe-inline'; worker-src 'none'; frame-ancestors 'self'";
+const HTML_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'; object-src 'none'; script-src 'none'; connect-src 'none'; img-src data:; media-src 'none'; font-src 'none'; style-src 'unsafe-inline'; worker-src 'none'; frame-ancestors 'self'";
+// Native PDF viewers refuse to run in any sandboxed context, so this policy
+// deliberately omits the `sandbox` directive and the embedding frame omits the
+// sandbox attribute. Isolation comes from the response itself: `application/pdf`
+// plus `nosniff` means these bytes can only reach the browser's PDF handler and
+// can never become an active same-origin document, while `default-src 'none'`
+// denies scripts, navigation helpers, and every subresource except the
+// same-origin plugin document (`object-src 'self'`) that the viewer embeds.
+const PDF_CONTENT_SECURITY_POLICY = "default-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'; object-src 'self'; script-src 'none'; connect-src 'none'; img-src 'none'; media-src 'none'; font-src 'none'; style-src 'none'; worker-src 'none'; frame-ancestors 'self'";
+const DOWNLOAD_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'; object-src 'none'; script-src 'none'; connect-src 'none'; img-src 'none'; media-src 'none'; font-src 'none'; style-src 'none'; worker-src 'none'; frame-ancestors 'none'";
+const ERROR_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'; object-src 'none'; script-src 'none'; connect-src 'none'; img-src 'none'; media-src 'none'; font-src 'none'; style-src 'none'; worker-src 'none'; frame-ancestors 'self'";
+export function workspaceFilePreviewResponsePolicy(path, options = {}) {
+    const filename = workspaceFileName(path);
+    if (filename === "")
+        throw new Error("Workspace file path must include a filename");
+    if (options.download === true) {
+        return responsePolicy("application/octet-stream", "attachment", filename, DOWNLOAD_CONTENT_SECURITY_POLICY);
+    }
+    const classification = classifyWorkspaceFile(path);
+    if (classification === undefined || !("previewMimeType" in classification)) {
+        throw new Error("Inline preview is not supported for this file type");
+    }
+    const contentSecurityPolicy = classification.mediaType === "image"
+        ? IMAGE_CONTENT_SECURITY_POLICY
+        : classification.mediaType === "html"
+            ? HTML_CONTENT_SECURITY_POLICY
+            : PDF_CONTENT_SECURITY_POLICY;
+    return responsePolicy(classification.previewMimeType, "inline", filename, contentSecurityPolicy);
+}
+function responsePolicy(contentType, disposition, filename, contentSecurityPolicy) {
+    return {
+        contentType,
+        contentDisposition: contentDisposition(disposition, filename),
+        contentSecurityPolicy,
+        contentTypeOptions: "nosniff",
+    };
+}
+export function workspaceFilePreviewErrorResponsePolicy() {
+    return {
+        contentType: "application/json; charset=utf-8",
+        contentDisposition: "inline",
+        contentSecurityPolicy: ERROR_CONTENT_SECURITY_POLICY,
+        contentTypeOptions: "nosniff",
+    };
+}
+function contentDisposition(disposition, filename) {
+    const asciiFallback = filename.replace(/[^\x20-\x7e]|["\\]/gu, "_");
+    return `${disposition}; filename="${asciiFallback}"; filename*=UTF-8''${encodeRfc5987Value(filename)}`;
+}
+function encodeRfc5987Value(value) {
+    return encodeURIComponent(value).replace(/['()*]/gu, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+//# sourceMappingURL=filePreviewResponsePolicy.js.map

package/dist/server/workspaces/filePreviewResponsePolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filePreviewResponsePolicy.js","sourceRoot":"","sources":["../../../src/server/workspaces/filePreviewResponsePolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAS1F,MAAM,6BAA6B,GAAG,4QAA4Q,CAAC;AACnT,MAAM,4BAA4B,GAAG,sQAAsQ,CAAC;AAC5S,4EAA4E;AAC5E,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,uEAAuE;AACvE,4EAA4E;AAC5E,MAAM,2BAA2B,GAAG,qPAAqP,CAAC;AAC1R,MAAM,gCAAgC,GAAG,8PAA8P,CAAC;AACxS,MAAM,6BAA6B,GAAG,8PAA8P,CAAC;AAErS,MAAM,UAAU,kCAAkC,CAAC,IAAY,EAAE,UAAkC,EAAE;IACnG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,0BAA0B,EAAE,YAAY,EAAE,QAAQ,EAAE,gCAAgC,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,iBAAiB,IAAI,cAAc,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,qBAAqB,GAAG,cAAc,CAAC,SAAS,KAAK,OAAO;QAChE,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,cAAc,CAAC,SAAS,KAAK,MAAM;YACnC,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,2BAA2B,CAAC;IAClC,OAAO,cAAc,CAAC,cAAc,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB,EAAE,WAAoC,EAAE,QAAgB,EAAE,qBAA6B;IAChI,OAAO;QACL,WAAW;QACX,kBAAkB,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC;QAC7D,qBAAqB;QACrB,kBAAkB,EAAE,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,OAAO;QACL,WAAW,EAAE,iCAAiC;QAC9C,kBAAkB,EAAE,QAAQ;QAC5B,qBAAqB,EAAE,6BAA6B;QACpD,kBAAkB,EAAE,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAoC,EAAE,QAAgB;IAChF,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,GAAG,WAAW,eAAe,aAAa,uBAAuB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC"}

package/dist/server/workspaces/filePreviewService.js

@@ -0,0 +1,81 @@
+import { open } from "node:fs/promises";
+import { pipeline, Transform } from "node:stream";
+import { classifyWorkspaceFile, MAX_INLINE_PREVIEW_BYTES, MAX_INLINE_PREVIEW_LABEL, workspaceFileName } from "../../shared/workspaceFiles.js";
+import { resolveWorkspacePathAccessTarget } from "./pathAccessPolicy.js";
+export async function readWorkspaceFilePreview(rootPath, path, pathAccess, options = {}) {
+    if (path === undefined || path === "")
+        throw new Error("path query parameter is required");
+    const { target, displayPath } = await resolveWorkspacePathAccessTarget(rootPath, path, pathAccess);
+    // Serve only from this descriptor. Path resolution is a snapshot: a rename,
+    // symlink swap, or resize after validation must not be able to change which
+    // bytes this response carries, how many of them it carries, or whether they
+    // are still inside the workspace or an allowed root.
+    const handle = await open(target, "r");
+    let streamOwnsHandle = false;
+    try {
+        const stats = await handle.stat();
+        if (!stats.isFile())
+            throw new Error("Path is not a file");
+        const metadata = { path: displayPath, filename: workspaceFileName(displayPath), modifiedAt: stats.mtime.toISOString() };
+        // Download mode serves any file as an opaque octet-stream attachment. No
+        // size cap: the response is streamed, and the browser writes it straight to
+        // disk. The stream still cannot exceed the validated size.
+        if (options.download === true) {
+            if (stats.size === 0)
+                return { ...metadata, size: 0, body: Buffer.alloc(0) };
+            streamOwnsHandle = true;
+            return { ...metadata, size: stats.size, body: validatedFileStream(handle, stats.size) };
+        }
+        const classification = classifyWorkspaceFile(displayPath);
+        if (classification === undefined || !("previewMimeType" in classification))
+            throw new Error("Inline preview is not supported for this file type");
+        if (stats.size > MAX_INLINE_PREVIEW_BYTES)
+            throw new Error(`File is too large to preview (limit ${MAX_INLINE_PREVIEW_LABEL})`);
+        const body = await readValidatedSnapshot(handle, stats.size);
+        return { ...metadata, mediaType: classification.mediaType, size: body.byteLength, body };
+    }
+    finally {
+        if (!streamOwnsHandle)
+            await handle.close();
+    }
+}
+/**
+ * Read exactly the validated number of bytes. Growth after validation is
+ * ignored, and a file that shrank fails the request before any header is sent
+ * instead of desynchronizing the advertised length.
+ */
+async function readValidatedSnapshot(handle, size) {
+    if (size === 0)
+        return Buffer.alloc(0);
+    const buffer = Buffer.alloc(size);
+    let offset = 0;
+    while (offset < size) {
+        const { bytesRead } = await handle.read(buffer, offset, size - offset, offset);
+        if (bytesRead === 0)
+            throw new Error("File changed while it was being read");
+        offset += bytesRead;
+    }
+    return buffer;
+}
+/**
+ * Stream the validated byte range from the open descriptor. Extra bytes written
+ * after validation are never sent, and a short read fails the response instead
+ * of silently truncating an advertised `Content-Length`.
+ */
+function validatedFileStream(handle, size) {
+    const source = handle.createReadStream({ start: 0, end: size - 1, autoClose: true });
+    let streamed = 0;
+    const exactLength = new Transform({
+        transform(chunk, _encoding, done) {
+            streamed += chunk.byteLength;
+            done(null, chunk);
+        },
+        flush(done) {
+            done(streamed === size ? null : new Error("File changed while it was being read"));
+        },
+    });
+    // The callback keeps a teardown failure from becoming an unhandled error; the
+    // returned stream still emits it, which fails the in-flight response.
+    return pipeline(source, exactLength, () => { });
+}
+//# sourceMappingURL=filePreviewService.js.map

package/dist/server/workspaces/filePreviewService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filePreviewService.js","sourceRoot":"","sources":["../../../src/server/workspaces/filePreviewService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAY,SAAS,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAC9I,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAoBzE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,IAAwB,EACxB,UAAkC,EAClC,UAA2C,EAAE;IAE7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3F,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,gCAAgC,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAEnG,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAExH,yEAAyE;QACzE,4EAA4E;QAC5E,2DAA2D;QAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,cAAc,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,iBAAiB,IAAI,cAAc,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAClJ,IAAI,KAAK,CAAC,IAAI,GAAG,wBAAwB;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,wBAAwB,GAAG,CAAC,CAAC;QAC/H,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,gBAAgB;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,MAAkB,EAAE,IAAY;IACnE,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/E,IAAI,SAAS,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7E,MAAM,IAAI,SAAS,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAkB,EAAE,IAAY;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,WAAW,GAAG,IAAI,SAAS,CAAC;QAChC,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,IAAI;YACtC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;YAC7B,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;QACrF,CAAC;KACF,CAAC,CAAC;IACH,8EAA8E;IAC9E,sEAAsE;IACtE,OAAO,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAyC,CAAC,CAAC,CAAC;AACxF,CAAC"}