@winspan/claude-forge 8.53.2 → 8.54.3

package/src/web/routes/token-usage.ts

@@ -1,20 +0,0 @@
-import type { Application } from 'express';
-import type { RouteContext } from './types.js';
-
-/**
- * /api/token-usage/* — token usage queries by session.
- */
-export function registerTokenUsageRoutes(app: Application, ctx: RouteContext): void {
-  const { storage } = ctx;
-
-  app.get('/api/token-usage/session/:sessionId', (req, res) => {
-    const sessionId = req.params.sessionId;
-    try {
-      const usage = storage.getTokenUsageBySession(sessionId);
-      const details = storage.listTokenUsage({ session_id: sessionId, limit: 100 });
-      res.json({ ...usage, details });
-    } catch (err) {
-      res.status(500).json({ error: String(err) });
-    }
-  });
-}

package/src/web/routes/trace.ts

@@ -1,126 +0,0 @@
-/**
- * /api/trace/:commit — Trace a git commit to its forge session(s).
- *
- * Reads git notes from the project directory to find associated session IDs,
- * then queries storage for session details.
- */
-
-import type { Application } from 'express';
-import { execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import type { RouteContext } from './types.js';
-
-export function registerTraceRoutes(app: Application, ctx: RouteContext): void {
-  const { storage } = ctx;
-
-  app.get('/api/trace/:commit', (req, res) => {
-    const commitRef = req.params.commit;
-    const projectPath = req.query.project as string | undefined;
-
-    if (!projectPath) {
-      res.status(400).json({ error: 'Query parameter "project" is required' });
-      return;
-    }
-
-    // Security: validate projectPath to prevent command injection
-    // 1. Must be an absolute path
-    if (!path.isAbsolute(projectPath)) {
-      res.status(400).json({ error: 'Project path must be absolute' });
-      return;
-    }
-
-    // 2. Must exist and be a directory
-    try {
-      const stats = fs.statSync(projectPath);
-      if (!stats.isDirectory()) {
-        res.status(400).json({ error: 'Project path must be a directory' });
-        return;
-      }
-    } catch {
-      res.status(400).json({ error: 'Project path does not exist' });
-      return;
-    }
-
-    // 3. Must contain a .git directory
-    const gitDir = path.join(projectPath, '.git');
-    if (!fs.existsSync(gitDir)) {
-      res.status(400).json({ error: 'Project path is not a git repository' });
-      return;
-    }
-
-    // 1. Resolve commit hash
-    let commitHash: string;
-    let commitMessage: string;
-    try {
-      commitHash = execFileSync('git', ['rev-parse', commitRef], {
-        cwd: projectPath, stdio: 'pipe', timeout: 5000,
-      }).toString().trim();
-    } catch {
-      res.status(404).json({ error: `Cannot resolve commit "${commitRef}"` });
-      return;
-    }
-
-    try {
-      commitMessage = execFileSync('git', ['log', '-1', '--format=%s', commitHash], {
-        cwd: projectPath, stdio: 'pipe', timeout: 5000,
-      }).toString().trim();
-    } catch {
-      commitMessage = '';
-    }
-
-    // 2. Read git notes
-    let noteContent: string;
-    try {
-      noteContent = execFileSync('git', ['notes', 'show', commitHash], {
-        cwd: projectPath, stdio: 'pipe', timeout: 5000,
-      }).toString().trim();
-    } catch {
-      res.json({ commit: commitHash, message: commitMessage, sessions: [] });
-      return;
-    }
-
-    // 3. Parse session IDs
-    const sessionIds = noteContent
-      .split('\n')
-      .filter(line => line.startsWith('forge-session:'))
-      .map(line => line.replace('forge-session:', '').trim());
-
-    if (sessionIds.length === 0) {
-      res.json({ commit: commitHash, message: commitMessage, sessions: [] });
-      return;
-    }
-
-    // 4. Query session details
-    // H2 Phase 3: 改用 facade 聚合方法，消除 db.prepare 直写。
-    const allSessions = storage.querySessions({ limit: 5000 });
-    const sessionDetails = sessionIds.map(sid => {
-      const session = allSessions.find(s => s.session_id === sid || s.session_id.startsWith(sid));
-      if (!session) return { session_id: sid, found: false };
-
-      const fullId = session.session_id;
-      const start = new Date(session.start_time);
-      const end = new Date(session.end_time);
-      const durationMin = Math.round((end.getTime() - start.getTime()) / 60000);
-
-      const eventBreakdown = storage.aggregateHookTypeBySession(fullId);
-      const agentRows = storage.aggregateAgentTypeBySession(fullId);
-      const skillIds = storage.queryDistinctSkillIdsBySession(fullId);
-
-      return {
-        session_id: fullId,
-        found: true,
-        first_prompt: session.first_prompt,
-        start_time: session.start_time,
-        end_time: session.end_time,
-        duration_min: durationMin,
-        event_count: session.event_count,
-        event_breakdown: Object.fromEntries(eventBreakdown.map(r => [r.hook_type, r.count])),
-        agent_calls: agentRows.filter(r => r.agent_type).map(r => ({ type: r.agent_type, count: r.count })),
-        skills: skillIds,
-      };
-    });
-
-    res.json({ commit: commitHash, message: commitMessage, sessions: sessionDetails });
-  });
-}

package/src/web/routes/types.ts

@@ -1,57 +0,0 @@
-/**
- * Shared types & helpers for route modules.
- */
-
-import path from 'path';
-import fs from 'fs';
-import { fileURLToPath } from 'url';
-import { homedir } from 'os';
-import type { SQLiteStorage } from '../../core/storage/sqlite.js';
-import type { SkillRegistry } from '../../skills/registry.js';
-import { FORGE_PATHS } from '../../core/constants.js';
-
-export interface RouteContext {
-  storage: SQLiteStorage;
-  skillRegistry?: SkillRegistry;
-}
-
-/**
- * Resolve the concrete on-disk path + backup dir for a patchable target.
- */
-export function resolvePatchTarget(
-  targetType: string,
-  targetName: string,
-): { filePath: string; backupDir: string } {
-  // Security: prevent path traversal attacks
-  if (!targetName || targetName.includes('/') || targetName.includes('\\') || targetName.includes('..')) {
-    throw new Error('Invalid target name: path traversal detected');
-  }
-
-  if (targetType === 'skill') {
-    return {
-      filePath: path.join(homedir(), '.claude', 'skills', `${targetName}.md`),
-      backupDir: FORGE_PATHS.backups('skills'),
-    };
-  }
-  if (targetType === 'routing_rule') {
-    return {
-      filePath: FORGE_PATHS.routingYaml(),
-      backupDir: FORGE_PATHS.backups('routing'),
-    };
-  }
-  throw new Error(`Unsupported targetType: ${targetType}`);
-}
-
-/**
- * Locate the static assets directory.
- */
-export function resolveStaticDir(moduleUrl: string): string | null {
-  const dir = path.dirname(fileURLToPath(moduleUrl));
-  const candidates = [
-    path.join(dir, '..', 'static'),
-    path.join(dir, '../../../src/web/static'),
-    path.join(dir, '../static'),
-    path.join(dir, '../../src/web/static'),
-  ];
-  return candidates.find(d => fs.existsSync(d)) ?? null;
-}

package/src/web/server.ts

@@ -1,134 +0,0 @@
-/**
- * Web API server — Express entry for the Forge dashboard.
- *
- * server.ts is intentionally thin: it wires middleware, composes the route
- * modules under src/web/routes/, and owns lifecycle (start/stop).
- */
-
-import express from 'express';
-import type { SQLiteStorage } from '../core/storage/sqlite.js';
-import type { SkillRegistry } from '../skills/registry.js';
-import type { InvocationGuard } from '../skills/invocation-guard.js';
-import { logger } from '../core/utils/logger.js';
-import { ErrorHandler } from '../core/utils/error-handler.js';
-import { requireAuth } from './auth-middleware.js';
-import { mountMcpServer } from '../mcp/server.js';
-import { errorHandler, notFoundHandler } from './routes/error-handler.js';
-
-import type { RouteContext } from './routes/types.js';
-import { registerAuthRoutes } from './routes/auth.js';
-import { registerStaticAssets, registerStaticFallback } from './routes/static.js';
-import { registerStatusRoutes } from './routes/status.js';
-import { registerEventsRoutes } from './routes/events.js';
-import { registerSessionsRoutes } from './routes/sessions.js';
-import { registerTokenUsageRoutes } from './routes/token-usage.js';
-import { registerAIRoutes } from './routes/ai.js';
-import { registerPatchRoutes } from './routes/patch.js';
-import { registerSkillsRoutes } from './routes/skills.js';
-import { registerTasksRoutes } from './routes/tasks.js';
-import { registerStatsRoutes } from './routes/stats.js';
-import { registerSkillStatsRoutes } from './routes/skill-stats.js';
-import { registerRulesRoutes } from './routes/rules.js';
-import { registerDriftRoutes } from './routes/drift.js';
-import { registerTraceRoutes } from './routes/trace.js';
-import { registerReportsRoutes } from './routes/reports.js';
-import { registerInsightsRoutes } from './routes/insights.js';
-
-export interface WebServerOptions {
-  port: number;
-  storage: SQLiteStorage;
-  skillRegistry?: SkillRegistry;
-  invocationGuard?: InvocationGuard;
-}
-
-export class WebServer {
-  private app: express.Application;
-  private server: ReturnType<express.Application['listen']> | null = null;
-
-  constructor(private options: WebServerOptions) {
-    this.app = express();
-
-    // Security: limit request body size to prevent DoS attacks
-    this.app.use(express.json({ limit: '10mb' }));
-    this.app.use(express.urlencoded({ extended: true, limit: '10mb' }));
-
-    this.setupRoutes();
-  }
-
-  private setupRoutes(): void {
-    this.app.use('/api', (req, res, next) => {
-      if (req.method === 'GET') return next();
-      return requireAuth(req, res, next);
-    });
-
-    const ctx: RouteContext = {
-      storage: this.options.storage,
-      skillRegistry: this.options.skillRegistry,
-    };
-
-    // 1. Auth bootstrap
-    registerAuthRoutes(this.app, ctx);
-
-    // 2. Static assets (serves UI; fallback registered last)
-    registerStaticAssets(this.app, ctx);
-
-    // 3. API routes
-    registerStatusRoutes(this.app, ctx);
-    registerEventsRoutes(this.app, ctx);
-    registerSessionsRoutes(this.app, ctx);
-    registerTokenUsageRoutes(this.app, ctx);
-    registerAIRoutes(this.app, ctx);
-    registerPatchRoutes(this.app, ctx);
-    registerSkillsRoutes(this.app, ctx);
-    registerTasksRoutes(this.app, ctx);
-    registerStatsRoutes(this.app, ctx);
-    registerSkillStatsRoutes(this.app, ctx);
-    registerRulesRoutes(this.app, ctx);
-    registerDriftRoutes(this.app, ctx);
-    registerTraceRoutes(this.app, ctx);
-    registerReportsRoutes(this.app, ctx);
-    registerInsightsRoutes(this.app, ctx);
-
-    // 4. MCP server — mounted on /mcp (Streamable HTTP)
-    if (this.options.skillRegistry) {
-      mountMcpServer(this.app, {
-        skillRegistry: this.options.skillRegistry,
-        storage: this.options.storage,
-        guard: this.options.invocationGuard,
-      });
-    } else {
-      logger.warn('[MCP] Skipped mounting: skillRegistry not provided');
-    }
-
-    // 5. SPA catch-all — must be LAST
-    registerStaticFallback(this.app, ctx);
-
-    // 6. Error handlers — must be AFTER all routes
-    this.app.use(notFoundHandler);
-    this.app.use(errorHandler);
-  }
-
-  async start(): Promise<void> {
-    return new Promise((resolve, reject) => {
-      this.server = this.app.listen(this.options.port, () => {
-        logger.info(`[Web] Server started on port ${this.options.port}`);
-        resolve();
-      });
-
-      this.server?.on('error', (error: any) => {
-        if (error.code === 'EADDRINUSE') {
-          ErrorHandler.handle(error, 'Web Server');
-        }
-        reject(error);
-      });
-    });
-  }
-
-  async stop(): Promise<void> {
-    if (this.server) {
-      return new Promise(resolve => {
-        this.server!.close(() => resolve());
-      });
-    }
-  }
-}

package/src/web/ssrf-guard.ts

@@ -1,112 +0,0 @@
-/**
- * SSRF 防护 — Web API 对外 fetch 前的 URL 白名单校验
- *
- * 背景：`/api/ai/test` 与 `/api/ai/models` 允许请求方指定上游 `baseUrl`，
- * 若不加约束可被滥用为 SSRF 通道（访问 169.254.169.254 / 127.0.0.1 / 内网 API
- * 等），并通过 res.json 回显响应体。此模块统一做协议、主机、白名单校验。
- */
-
-/** 校验结果 */
-export interface SsrfValidationResult {
-  ok: boolean;
-  error?: string;
-}
-
-/** 默认允许访问的上游主机（已知 AI 服务商的官方域名） */
-export const DEFAULT_ALLOWED_HOSTS: ReadonlySet<string> = new Set([
-  'api.anthropic.com',
-  'api.openai.com',
-  'generativelanguage.googleapis.com',
-]);
-
-/** 统一的跨端点 fetch 超时（毫秒） */
-export const UPSTREAM_TIMEOUT_MS = 10_000;
-
-/** 判断字符串是否为 IPv4 字面量 */
-function isIPv4Literal(host: string): boolean {
-  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
-}
-
-/** 判断主机是否为 loopback / 保留名 */
-function isLocalhostLike(host: string): boolean {
-  const h = host.toLowerCase();
-  return (
-    h === 'localhost' ||
-    h.endsWith('.localhost') ||
-    h === '0.0.0.0' ||
-    h === '::' ||
-    h === '::1'
-  );
-}
-
-/**
- * 校验用户提供的 baseUrl 是否允许被 daemon 代为访问。
- *
- * 规则：
- * 1. 必须能解析为 URL；
- * 2. 协议必须是 http 或 https；
- * 3. 禁止 IPv4 / IPv6 字面量、localhost 等本机/内网地址；
- * 4. 主机必须在默认白名单或 extraHosts 中。
- *
- * @param baseUrl 待校验的 URL
- * @param extraHosts 额外允许的主机（通常来自 config.yaml 里已配置的 base_url）
- */
-export function validateBaseUrl(
-  baseUrl: unknown,
-  extraHosts: Iterable<string> = [],
-): SsrfValidationResult {
-  if (typeof baseUrl !== 'string' || baseUrl.length === 0) {
-    return { ok: false, error: 'baseUrl is required' };
-  }
-
-  let parsed: URL;
-  try {
-    parsed = new URL(baseUrl);
-  } catch {
-    return { ok: false, error: 'Invalid URL' };
-  }
-
-  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-    return { ok: false, error: 'Only http/https protocols allowed' };
-  }
-
-  const host = parsed.hostname.toLowerCase();
-
-  if (isIPv4Literal(host)) {
-    return { ok: false, error: 'Direct IP access blocked (SSRF protection)' };
-  }
-  // URL parser strips brackets from IPv6 hostname; detect by ':' or '::'
-  if (host.includes(':')) {
-    return { ok: false, error: 'Direct IPv6 access blocked (SSRF protection)' };
-  }
-  if (isLocalhostLike(host)) {
-    return { ok: false, error: 'localhost access blocked (SSRF protection)' };
-  }
-
-  const allowed = new Set<string>(DEFAULT_ALLOWED_HOSTS);
-  for (const extra of extraHosts) {
-    if (extra) allowed.add(extra.toLowerCase());
-  }
-
-  if (!allowed.has(host)) {
-    return {
-      ok: false,
-      error: `Host ${host} not in allowlist. Allowed: ${[...allowed].sort().join(', ')}`,
-    };
-  }
-
-  return { ok: true };
-}
-
-/**
- * 从已配置的 base_url 中提取主机名，作为额外允许项。
- * 无效/为空返回 null，调用方可忽略。
- */
-export function extractHostFromBaseUrl(baseUrl: string | undefined | null): string | null {
-  if (!baseUrl) return null;
-  try {
-    return new URL(baseUrl).hostname.toLowerCase();
-  } catch {
-    return null;
-  }
-}