@wrongstack/desktop 0.308.7 → 0.309.1

package/dist/main/main.js

@@ -1,5 +1,5 @@
 // src/main/main.ts
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 import { installCrashShield, resolveWstackPaths as resolveWstackPaths3 } from "@wrongstack/core/utils";
 import {
   app as app2,
@@ -40,9 +40,9 @@ function handleFileOpen(filePath) {
 }
 var pendingOpenFilePath = null;
 function drainPendingOpenFilePath() {
-  const path6 = pendingOpenFilePath;
+  const path7 = pendingOpenFilePath;
   pendingOpenFilePath = null;
-  return path6;
+  return path7;
 }
 function firstOpenFileArg(argv) {
   if (process.platform !== "darwin") return null;
@@ -147,7 +147,7 @@ var DesktopAgentBridge = class extends EventEmitter {
     conversation.error = void 0;
     this.emitChanged(conversation);
     this.emitReconnectEvent(conversation, "connecting");
-    const promise = new Promise((resolve3, reject) => {
+    const promise = new Promise((resolve4, reject) => {
       const ws = new WebSocket(wsUrl);
       conversation.ws = ws;
       const myGeneration = ++conversation.socketGeneration;
@@ -172,7 +172,7 @@ var DesktopAgentBridge = class extends EventEmitter {
         conversation.connectionState = markConnectionOpen(conversation.connectionState);
         this.emitChanged(conversation);
         this.emitReconnectEvent(conversation, "connected");
-        resolve3();
+        resolve4();
       });
       ws.once("error", (err) => {
         clearTimeout(timeout);
@@ -1445,14 +1445,14 @@ function hasChildExited(child) {
 }
 function waitForChildExit(child, timeoutMs) {
   if (hasChildExited(child)) return Promise.resolve(true);
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let settled = false;
     const finish = (exited) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
       child.off("exit", onExit);
-      resolve3(exited);
+      resolve4(exited);
     };
     const onExit = () => finish(true);
     const timer = setTimeout(() => finish(hasChildExited(child)), timeoutMs);
@@ -1478,12 +1478,12 @@ async function terminateProcessTree(child) {
     }
     return;
   }
-  await new Promise((resolve3) => {
+  await new Promise((resolve4) => {
     let settled = false;
     const finish = () => {
       if (settled) return;
       settled = true;
-      resolve3();
+      resolve4();
     };
     const timer = setTimeout(finish, 3e3);
     timer.unref?.();
@@ -1628,11 +1628,11 @@ async function findFreePort(startPort, exclude) {
   throw new Error(`No free local port found near ${startPort}`);
 }
 function isPortFree(port) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const server = net.createServer();
-    server.once("error", () => resolve3(false));
+    server.once("error", () => resolve4(false));
     server.once("listening", () => {
-      server.close(() => resolve3(true));
+      server.close(() => resolve4(true));
     });
     server.listen(port, "127.0.0.1");
   });
@@ -1642,7 +1642,7 @@ function waitForHttpReady(baseUrl, token, timeoutMs) {
   const url = new URL(baseUrl);
   url.searchParams.set("token", token);
   url.searchParams.set("shell", "desktop");
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     let probeTimer;
     const cleanup = () => {
       if (probeTimer) {
@@ -1667,7 +1667,7 @@ function waitForHttpReady(baseUrl, token, timeoutMs) {
           if (!done) {
             done = true;
             cleanup();
-            resolve3();
+            resolve4();
           }
           return;
         }
@@ -2185,14 +2185,14 @@ var DesktopWebuiController = class {
     if (this.views.get(entry.runtimeId) !== entry || !entry.url) return Promise.resolve(false);
     const requestId = `${entry.runtimeId}:${Date.now()}:${++this.commandSequence}`;
     const outbound = { ...command, requestId };
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const fallbackTimer = setTimeout(() => {
         if (!this.pendingAcks.has(requestId)) return;
         if (this.views.get(entry.runtimeId) !== entry || entry.view.webContents.isDestroyed()) return;
         void entry.view.webContents.executeJavaScript(buildWebuiCommandFallbackScript(outbound), true).catch(() => void 0);
       }, WEBUI_COMMAND_FALLBACK_MS);
       const timer = setTimeout(() => this.settleAck(requestId, false), WEBUI_COMMAND_ACK_TIMEOUT_MS);
-      this.pendingAcks.set(requestId, { runtimeId: entry.runtimeId, timer, fallbackTimer, resolve: resolve3 });
+      this.pendingAcks.set(requestId, { runtimeId: entry.runtimeId, timer, fallbackTimer, resolve: resolve4 });
       try {
         entry.view.webContents.send(IPC.webuiCommand, outbound);
         if (this.activeRuntimeId === entry.runtimeId) entry.view.webContents.focus();
@@ -2772,10 +2772,24 @@ function createValidationLogger(prefix) {
 }
 
 // src/main/validation/schemas.ts
+import { statSync } from "node:fs";
+import * as path5 from "node:path";
 import { z } from "zod";
 var RUNTIME_ID_PATTERN = /^[a-zA-Z0-9._:-]{3,120}$/;
 var runtimeIdSchema = z.string().regex(RUNTIME_ID_PATTERN, "Invalid runtime ID format");
 var pathSchema = z.string().min(1).max(1e4);
+var projectRootSchema = pathSchema.refine((value) => !value.includes("\0"), {
+  message: "path must not contain a NUL byte"
+}).refine(
+  (value) => {
+    try {
+      return statSync(path5.resolve(value)).isDirectory();
+    } catch {
+      return false;
+    }
+  },
+  { message: "path must be an existing directory" }
+);
 var booleanSchema = z.boolean();
 var numberSchema = z.number().int().finite();
 var openProjectSchema = z.object({
@@ -2861,11 +2875,11 @@ function registerIpcHandlers(ctx) {
     return ctx.openProjectSession(validated);
   });
   ipcMain.handle(IPC.openProject, async (_event, requestedRoot) => {
-    const validated = validateOptional(pathSchema, requestedRoot);
+    const validated = validateOptional(projectRootSchema, requestedRoot);
     return ctx.openProject(validated);
   });
   ipcMain.handle(IPC.registerProject, async (_event, requestedRoot) => {
-    const validated = validateOptional(pathSchema, requestedRoot);
+    const validated = validateOptional(projectRootSchema, requestedRoot);
     return ctx.registerProject(validated);
   });
   ipcMain.handle(IPC.unregisterProject, async (_event, root) => {
@@ -2898,7 +2912,10 @@ function registerIpcHandlers(ctx) {
       validationLogger.log(`sendMessage (id): ${idResult.error}`);
       return ctx.sendMessage("", "", "");
     }
-    const contentResult = validate(pathSchema.transform(() => String(content ?? "")), content);
+    const contentResult = validate(
+      pathSchema.transform(() => String(content ?? "")),
+      content
+    );
     const safeContent = contentResult.success ? contentResult.data : String(content ?? "");
     return ctx.sendMessage(
       idResult.data,
@@ -2957,22 +2974,25 @@ function registerIpcHandlers(ctx) {
       prefs: { ...entry.status.prefs ?? {}, ...sanitized }
     });
   });
-  ipcMain.on(IPC.webuiCommandAck, (event, requestId, handled, _message) => {
-    const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
-    if (!entry) return;
-    const result = validate(webuiCommandAckSchema, {
-      requestId,
-      handled,
-      message: _message
-    });
-    if (!result.success) {
-      validationLogger.log(`webuiCommandAck: ${result.error}`);
-      return;
+  ipcMain.on(
+    IPC.webuiCommandAck,
+    (event, requestId, handled, _message) => {
+      const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
+      if (!entry) return;
+      const result = validate(webuiCommandAckSchema, {
+        requestId,
+        handled,
+        message: _message
+      });
+      if (!result.success) {
+        validationLogger.log(`webuiCommandAck: ${result.error}`);
+        return;
+      }
+      const pending = ctx.getPendingWebuiCommandAcks().get(result.data.requestId);
+      if (!pending || pending.runtimeId !== entry.runtimeId) return;
+      ctx.settlePendingWebuiCommandAck(result.data.requestId, result.data.handled);
     }
-    const pending = ctx.getPendingWebuiCommandAcks().get(result.data.requestId);
-    if (!pending || pending.runtimeId !== entry.runtimeId) return;
-    ctx.settlePendingWebuiCommandAck(result.data.requestId, result.data.handled);
-  });
+  );
   ipcMain.on(IPC.setLocale, (_event, locale) => {
     const result = validate(setLocaleSchema, { locale });
     if (!result.success) {
@@ -3011,7 +3031,7 @@ if (process.platform === "win32") {
 }
 app2.setPath(
   "userData",
-  path5.join(
+  path6.join(
     resolveWstackPaths3({ projectRoot: process.cwd() }).configDir,
     "desktop",
     "electron-profile"
@@ -3065,7 +3085,7 @@ function revealInExplorer(root) {
     if (!authorization.allowed) return;
     return shell2.openPath(root).catch((err) => {
       if (process.platform === "darwin") {
-        void shell2.openPath(path5.dirname(root)).catch(() => void 0);
+        void shell2.openPath(path6.dirname(root)).catch(() => void 0);
       }
       console.error(
         JSON.stringify({