agent-canvas 0.2.0 → 0.6.0

package/daemon/src/handlers/files.ts

@@ -1,113 +1,120 @@
-import { join, resolve } from "path";
-import { readdir } from "fs/promises";
-import type { SessionManager } from "@fabrika/canvas-kernel/server";
-import { jsonResponse, type Route } from "@fabrika/daemon-kit";
-import { LANG_MAP } from "../../langMap";
+import type { SessionManager } from '@fabrika/canvas-kernel/server'
+import { jsonResponse, type Route } from '@fabrika/daemon-kit'
+import { readdir } from 'fs/promises'
+import { isAbsolute, relative, resolve, sep } from 'path'
+import { LANG_MAP } from '../../langMap'
 
 const IMAGE_MIME: Record<string, string> = {
-  png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg",
-  gif: "image/gif", svg: "image/svg+xml", webp: "image/webp",
-  ico: "image/x-icon", bmp: "image/bmp", avif: "image/avif",
-};
+	png: 'image/png',
+	jpg: 'image/jpeg',
+	jpeg: 'image/jpeg',
+	gif: 'image/gif',
+	svg: 'image/svg+xml',
+	webp: 'image/webp',
+	ico: 'image/x-icon',
+	bmp: 'image/bmp',
+	avif: 'image/avif',
+}
 
 function resolveSessionPath(
-  sessionManager: SessionManager,
-  sessionId: string,
-  relPath: string,
-): { fullPath: string; session: ReturnType<SessionManager["get"]> & {} } | Response {
-  const session = sessionManager.get(sessionId);
-  if (!session) return jsonResponse({ error: "Session not found" }, 404);
-
-  const fullPath = resolve(join(session.projectRoot, relPath));
-  if (!fullPath.startsWith(resolve(session.projectRoot))) {
-    return jsonResponse({ error: "Path traversal rejected" }, 403);
-  }
-
-  return { fullPath, session };
+	sessionManager: SessionManager,
+	sessionId: string,
+	relPath: string,
+): { fullPath: string; session: ReturnType<SessionManager['get']> & {} } | Response {
+	const session = sessionManager.get(sessionId)
+	if (!session) return jsonResponse({ error: 'Session not found' }, 404)
+
+	const fullPath = resolve(session.projectRoot, relPath)
+	const relativePath = relative(resolve(session.projectRoot), fullPath)
+	if (!isAbsolute(relPath) && (relativePath === '..' || relativePath.startsWith(`..${sep}`))) {
+		return jsonResponse({ error: 'Path traversal rejected' }, 403)
+	}
+
+	return { fullPath, session }
 }
 
 export function createFileHandlers(sessionManager: SessionManager): Route[] {
-  async function handleFileServe(_req: Request, url: URL): Promise<Response> {
-    const sessionId = url.searchParams.get("session");
-    const relPath = url.searchParams.get("path");
-    if (!sessionId || !relPath) return jsonResponse({ error: "Missing session or path" }, 400);
-
-    const resolved = resolveSessionPath(sessionManager, sessionId, relPath);
-    if (resolved instanceof Response) return resolved;
-
-    try {
-      const file = Bun.file(resolved.fullPath);
-      const stat = await file.exists();
-      if (!stat) return jsonResponse({ error: "File not found" }, 404);
-      if (file.size > 1024 * 1024) return jsonResponse({ error: "File too large" }, 413);
-
-      const content = await file.text();
-      const ext = relPath.split(".").pop() || "";
-      return jsonResponse({ content, language: LANG_MAP[ext] || "text" });
-    } catch {
-      return jsonResponse({ error: "Failed to read file" }, 500);
-    }
-  }
-
-  async function handleImageServe(_req: Request, url: URL): Promise<Response> {
-    const sessionId = url.searchParams.get("session");
-    const relPath = url.searchParams.get("path");
-    if (!sessionId || !relPath) return jsonResponse({ error: "Missing session or path" }, 400);
-
-    const resolved = resolveSessionPath(sessionManager, sessionId, relPath);
-    if (resolved instanceof Response) return resolved;
-
-    try {
-      const file = Bun.file(resolved.fullPath);
-      if (!(await file.exists())) return jsonResponse({ error: "File not found" }, 404);
-      if (file.size > 10 * 1024 * 1024) return jsonResponse({ error: "File too large" }, 413);
-
-      const ext = relPath.split(".").pop()?.toLowerCase() || "";
-      const mime = IMAGE_MIME[ext];
-      if (!mime) return jsonResponse({ error: "Unsupported image format" }, 415);
-
-      return new Response(file, {
-        headers: {
-          "Content-Type": mime,
-          "Cache-Control": "public, max-age=300",
-        },
-      });
-    } catch {
-      return jsonResponse({ error: "Failed to read file" }, 500);
-    }
-  }
-
-  async function handleTreeServe(_req: Request, url: URL): Promise<Response> {
-    const sessionId = url.searchParams.get("session");
-    const relPath = url.searchParams.get("path") || "";
-    if (!sessionId) return jsonResponse({ error: "Missing session" }, 400);
-
-    const resolved = resolveSessionPath(sessionManager, sessionId, relPath);
-    if (resolved instanceof Response) return resolved;
-
-    const ignoreDirs = new Set([".git", "node_modules", ".next", "__pycache__", "dist", ".cache"]);
-
-    try {
-      const dirents = await readdir(resolved.fullPath, { withFileTypes: true });
-      const entries = dirents
-        .filter((d) => !ignoreDirs.has(d.name) && !d.name.startsWith("."))
-        .map((d) => ({
-          name: d.name,
-          type: d.isDirectory() ? "dir" : "file",
-        }))
-        .sort((a, b) => {
-          if (a.type !== b.type) return a.type === "dir" ? -1 : 1;
-          return a.name.localeCompare(b.name);
-        });
-      return jsonResponse({ entries });
-    } catch {
-      return jsonResponse({ error: "Failed to read directory" }, 500);
-    }
-  }
-
-  return [
-    { method: "GET", pattern: new URLPattern({ pathname: "/api/file" }), handler: handleFileServe },
-    { method: "GET", pattern: new URLPattern({ pathname: "/api/image" }), handler: handleImageServe },
-    { method: "GET", pattern: new URLPattern({ pathname: "/api/tree" }), handler: handleTreeServe },
-  ];
+	async function handleFileServe(_req: Request, url: URL): Promise<Response> {
+		const sessionId = url.searchParams.get('session')
+		const relPath = url.searchParams.get('path')
+		if (!sessionId || !relPath) return jsonResponse({ error: 'Missing session or path' }, 400)
+
+		const resolved = resolveSessionPath(sessionManager, sessionId, relPath)
+		if (resolved instanceof Response) return resolved
+
+		try {
+			const file = Bun.file(resolved.fullPath)
+			const stat = await file.exists()
+			if (!stat) return jsonResponse({ error: 'File not found' }, 404)
+			if (file.size > 1024 * 1024) return jsonResponse({ error: 'File too large' }, 413)
+
+			const content = await file.text()
+			const ext = relPath.split('.').pop() || ''
+			return jsonResponse({ content, language: LANG_MAP[ext] || 'text' })
+		} catch {
+			return jsonResponse({ error: 'Failed to read file' }, 500)
+		}
+	}
+
+	async function handleImageServe(_req: Request, url: URL): Promise<Response> {
+		const sessionId = url.searchParams.get('session')
+		const relPath = url.searchParams.get('path')
+		if (!sessionId || !relPath) return jsonResponse({ error: 'Missing session or path' }, 400)
+
+		const resolved = resolveSessionPath(sessionManager, sessionId, relPath)
+		if (resolved instanceof Response) return resolved
+
+		try {
+			const file = Bun.file(resolved.fullPath)
+			if (!(await file.exists())) return jsonResponse({ error: 'File not found' }, 404)
+			if (file.size > 10 * 1024 * 1024) return jsonResponse({ error: 'File too large' }, 413)
+
+			const ext = relPath.split('.').pop()?.toLowerCase() || ''
+			const mime = IMAGE_MIME[ext]
+			if (!mime) return jsonResponse({ error: 'Unsupported image format' }, 415)
+
+			return new Response(file, {
+				headers: {
+					'Content-Type': mime,
+					'Cache-Control': 'public, max-age=300',
+				},
+			})
+		} catch {
+			return jsonResponse({ error: 'Failed to read file' }, 500)
+		}
+	}
+
+	async function handleTreeServe(_req: Request, url: URL): Promise<Response> {
+		const sessionId = url.searchParams.get('session')
+		const relPath = url.searchParams.get('path') || ''
+		if (!sessionId) return jsonResponse({ error: 'Missing session' }, 400)
+
+		const resolved = resolveSessionPath(sessionManager, sessionId, relPath)
+		if (resolved instanceof Response) return resolved
+
+		const ignoreDirs = new Set(['.git', 'node_modules', '.next', '__pycache__', 'dist', '.cache'])
+
+		try {
+			const dirents = await readdir(resolved.fullPath, { withFileTypes: true })
+			const entries = dirents
+				.filter((d) => !ignoreDirs.has(d.name) && !d.name.startsWith('.'))
+				.map((d) => ({
+					name: d.name,
+					type: d.isDirectory() ? 'dir' : 'file',
+				}))
+				.sort((a, b) => {
+					if (a.type !== b.type) return a.type === 'dir' ? -1 : 1
+					return a.name.localeCompare(b.name)
+				})
+			return jsonResponse({ entries })
+		} catch {
+			return jsonResponse({ error: 'Failed to read directory' }, 500)
+		}
+	}
+
+	return [
+		{ method: 'GET', pattern: new URLPattern({ pathname: '/api/file' }), handler: handleFileServe },
+		{ method: 'GET', pattern: new URLPattern({ pathname: '/api/image' }), handler: handleImageServe },
+		{ method: 'GET', pattern: new URLPattern({ pathname: '/api/tree' }), handler: handleTreeServe },
+	]
 }

package/daemon/src/handlers/static.ts

@@ -1,61 +1,62 @@
-import { join, dirname } from "path";
-import { DATA_DIR } from "../paths";
-import type { Route } from "@fabrika/daemon-kit";
+import type { Route } from '@fabrika/daemon-kit'
+import { dirname, join } from 'path'
+import { DATA_DIR } from '../paths'
 
 const MIME_TYPES: Record<string, string> = {
-  js: "application/javascript",
-  css: "text/css",
-  html: "text/html",
-  svg: "image/svg+xml",
-  png: "image/png",
-};
+	js: 'application/javascript',
+	css: 'text/css',
+	html: 'text/html',
+	svg: 'image/svg+xml',
+	png: 'image/png',
+}
 
-let cachedDistDir: string | null = null;
+let cachedDistDir: string | null = null
 async function getDistDir(): Promise<string> {
-  if (cachedDistDir) return cachedDistDir;
-  // import.meta.dir = daemon/src/handlers/, go up two levels to daemon/
-  const localDist = join(dirname(import.meta.dir), "..", "dist");
-  if (await Bun.file(join(localDist, "index.html")).exists()) {
-    cachedDistDir = localDist;
-  } else {
-    cachedDistDir = join(DATA_DIR, "daemon");
-  }
-  return cachedDistDir;
+	if (cachedDistDir) return cachedDistDir
+	// import.meta.dir = daemon/src/handlers/, go up two levels to daemon/
+	const localDist = join(dirname(import.meta.dir), '..', 'dist')
+	if (await Bun.file(join(localDist, 'index.html')).exists()) {
+		cachedDistDir = localDist
+	} else {
+		cachedDistDir = join(DATA_DIR, 'daemon')
+	}
+	return cachedDistDir
 }
 
 async function serveSessionPage(): Promise<Response> {
-  const distDir = await getDistDir();
-  const file = Bun.file(join(distDir, "index.html"));
-  if (await file.exists()) {
-    return new Response(file, { headers: { "Content-Type": "text/html" } });
-  }
-  return new Response("Build not found. Run: bun run daemon/build.ts", { status: 500 });
+	const distDir = await getDistDir()
+	const file = Bun.file(join(distDir, 'index.html'))
+	if (await file.exists()) {
+		return new Response(file, { headers: { 'Content-Type': 'text/html' } })
+	}
+	return new Response('Build not found. Run: bun run daemon/build.ts', { status: 500 })
 }
 
 async function serveStaticAsset(_req: Request, url: URL): Promise<Response> {
-  const path = url.pathname;
-  const distDir = await getDistDir();
-  const assetPath = join(distDir, path.replace("/assets/", ""));
-  const file = Bun.file(assetPath);
-  if (!(await file.exists())) return new Response("Not found", { status: 404 });
+	const path = url.pathname
+	const distDir = await getDistDir()
+	const assetPath = join(distDir, path.replace('/assets/', ''))
+	const file = Bun.file(assetPath)
+	if (!(await file.exists())) return new Response('Not found', { status: 404 })
 
-  const ext = path.split(".").pop() || "";
-  return new Response(file, {
-    headers: { "Content-Type": MIME_TYPES[ext] || "application/octet-stream" },
-  });
+	const ext = path.split('.').pop() || ''
+	return new Response(file, {
+		// A rebuild keeps the file names, and pages that load the review widget would otherwise keep a stale copy.
+		headers: { 'Content-Type': MIME_TYPES[ext] || 'application/octet-stream', 'Cache-Control': 'no-cache' },
+	})
 }
 
 export function createStaticHandlers(): Route[] {
-  return [
-    {
-      method: "GET",
-      pattern: new URLPattern({ pathname: "/s/:id" }),
-      handler: serveSessionPage,
-    },
-    {
-      method: "GET",
-      pattern: new URLPattern({ pathname: "/assets/*" }),
-      handler: serveStaticAsset,
-    },
-  ];
+	return [
+		{
+			method: 'GET',
+			pattern: new URLPattern({ pathname: '/s/:id' }),
+			handler: serveSessionPage,
+		},
+		{
+			method: 'GET',
+			pattern: new URLPattern({ pathname: '/assets/*' }),
+			handler: serveStaticAsset,
+		},
+	]
 }

package/daemon/src/handlers/uploads.ts

@@ -1,61 +1,66 @@
-import { writeFileSync } from "fs";
-import { join } from "path";
-import type { SessionManager } from "@fabrika/canvas-kernel/server";
-import { jsonResponse, type Route } from "@fabrika/daemon-kit";
-import { UPLOADS_DIR } from "../paths";
+import type { SessionManager } from '@fabrika/canvas-kernel/server'
+import { jsonResponse, type Route } from '@fabrika/daemon-kit'
+import { writeFileSync } from 'fs'
+import { join } from 'path'
+import { UPLOADS_DIR } from '../paths'
 
 const IMAGE_MIME: Record<string, string> = {
-  png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg",
-  gif: "image/gif", svg: "image/svg+xml", webp: "image/webp",
-  bmp: "image/bmp", avif: "image/avif",
-};
+	png: 'image/png',
+	jpg: 'image/jpeg',
+	jpeg: 'image/jpeg',
+	gif: 'image/gif',
+	svg: 'image/svg+xml',
+	webp: 'image/webp',
+	bmp: 'image/bmp',
+	avif: 'image/avif',
+}
 
 export function createUploadHandlers(sessionManager: SessionManager): Route[] {
-  async function handleUpload(req: Request, _url: URL, match: URLPatternResult): Promise<Response> {
-    const sessionId = match.pathname.groups.id!;
-    if (!sessionManager.get(sessionId)) {
-      return jsonResponse({ error: "Session not found" }, 404);
-    }
-
-    const formData = await req.formData();
-    const file = formData.get("image") as File | null;
-    if (!file) return jsonResponse({ error: "No image provided" }, 400);
-    if (!file.type.startsWith("image/")) return jsonResponse({ error: "Not an image" }, 400);
-    if (file.size > 10 * 1024 * 1024) return jsonResponse({ error: "Image too large (max 10MB)" }, 413);
-
-    const ext = file.name.split(".").pop()?.toLowerCase() || "png";
-    const filename = `${crypto.randomUUID()}.${ext}`;
-    const filepath = join(UPLOADS_DIR, filename);
-
-    const buffer = await file.arrayBuffer();
-    writeFileSync(filepath, Buffer.from(buffer));
-
-    return jsonResponse({ path: filepath, filename });
-  }
-
-  async function handleUploadServe(_req: Request, _url: URL, match: URLPatternResult): Promise<Response> {
-    const filename = match.pathname.groups.filename!;
-    if (filename.includes("/") || filename.includes("..")) {
-      return jsonResponse({ error: "Invalid filename" }, 400);
-    }
-
-    const filepath = join(UPLOADS_DIR, filename);
-    const file = Bun.file(filepath);
-    if (!(await file.exists())) return jsonResponse({ error: "Not found" }, 404);
-
-    const ext = filename.split(".").pop()?.toLowerCase() || "";
-    const mime = IMAGE_MIME[ext] || "application/octet-stream";
-
-    return new Response(file, {
-      headers: {
-        "Content-Type": mime,
-        "Cache-Control": "public, max-age=3600",
-      },
-    });
-  }
-
-  return [
-    { method: "POST", pattern: new URLPattern({ pathname: "/api/session/:id/upload" }), handler: handleUpload },
-    { method: "GET", pattern: new URLPattern({ pathname: "/api/uploads/:filename" }), handler: handleUploadServe },
-  ];
+	async function handleUpload(req: Request, _url: URL, match: URLPatternResult): Promise<Response> {
+		const sessionId = match.pathname.groups.id!
+		if (!sessionManager.get(sessionId)) {
+			return jsonResponse({ error: 'Session not found' }, 404)
+		}
+
+		const formData = await req.formData()
+		const file = formData.get('image') as File | null
+		if (!file) return jsonResponse({ error: 'No image provided' }, 400)
+		if (!file.type.startsWith('image/')) return jsonResponse({ error: 'Not an image' }, 400)
+		if (file.size > 10 * 1024 * 1024) return jsonResponse({ error: 'Image too large (max 10MB)' }, 413)
+
+		const ext = file.name.split('.').pop()?.toLowerCase() || 'png'
+		const filename = `${crypto.randomUUID()}.${ext}`
+		const filepath = join(UPLOADS_DIR, filename)
+
+		const buffer = await file.arrayBuffer()
+		writeFileSync(filepath, Buffer.from(buffer))
+
+		return jsonResponse({ path: filepath, filename })
+	}
+
+	async function handleUploadServe(_req: Request, _url: URL, match: URLPatternResult): Promise<Response> {
+		const filename = match.pathname.groups.filename!
+		if (filename.includes('/') || filename.includes('..')) {
+			return jsonResponse({ error: 'Invalid filename' }, 400)
+		}
+
+		const filepath = join(UPLOADS_DIR, filename)
+		const file = Bun.file(filepath)
+		if (!(await file.exists())) return jsonResponse({ error: 'Not found' }, 404)
+
+		const ext = filename.split('.').pop()?.toLowerCase() || ''
+		const mime = IMAGE_MIME[ext] || 'application/octet-stream'
+
+		return new Response(file, {
+			headers: {
+				'Content-Type': mime,
+				'Cache-Control': 'public, max-age=3600',
+			},
+		})
+	}
+
+	return [
+		{ method: 'POST', pattern: new URLPattern({ pathname: '/api/session/:id/upload' }), handler: handleUpload },
+		{ method: 'GET', pattern: new URLPattern({ pathname: '/api/uploads/:filename' }), handler: handleUploadServe },
+	]
 }

package/daemon/src/paths.ts

@@ -1,15 +1,18 @@
-import { join } from "path";
-import { createCanvasPaths } from "@fabrika/canvas-kernel/server";
+import { createCanvasPaths } from '@fabrika/canvas-kernel/server'
+import { join } from 'path'
 
 /** agent-canvas's on-disk layout. Kept in sync with bin/lib/config.ts. */
-export const paths = createCanvasPaths({ appName: "agent-canvas" });
+export const paths = createCanvasPaths({ appName: 'agent-canvas' })
 
-export const DATA_DIR = paths.dataDir;
-export const SESSIONS_DIR = paths.sessionsDir;
-export const TEMP_DIR = paths.tempDir;
-export const PID_FILE = paths.pidFile;
-export const COMPILE_TEMP_DIR = paths.compileTempDir;
-export const UPLOADS_DIR = paths.uploadsDir;
+export const DATA_DIR = paths.dataDir
+export const SESSIONS_DIR = paths.sessionsDir
+export const TEMP_DIR = paths.tempDir
+export const PID_FILE = paths.pidFile
+export const COMPILE_TEMP_DIR = paths.compileTempDir
+export const UPLOADS_DIR = paths.uploadsDir
 
 /** Capability used only by the CLI to resolve secret values */
-export const CLI_AUTH_FILE = join(paths.tempDir, "daemon-auth-token");
+export const CLI_AUTH_FILE = join(paths.tempDir, 'daemon-auth-token')
+
+/** Review-mode threads, one JSON file per project */
+export const REVIEWS_DIR = join(paths.dataDir, 'reviews')