agentgui 1.0.1126 → 1.0.1127

package/.gm/.embed-generation.code_chunks

@@ -1 +0,0 @@
-b8b6f24106dd526a

package/.gm/.embed-generation.git_commit_vectors

@@ -1 +0,0 @@
-b8b6f24106dd526a

package/.gm/.embed-generation.memories

@@ -1 +0,0 @@
-b8b6f24106dd526a

package/.gm/.embed-generation.rssearch_vectors

@@ -1 +0,0 @@
-b8b6f24106dd526a

package/lib/acp-http-protocol.js

@@ -1,95 +0,0 @@
-// Normalizes opencode's REST+SSE event shape (POST /session, POST
-// /session/{id}/message, GET /global/event) into the SAME internal event
-// shape lib/acp-protocol.js's acpProtocolHandler produces for the stdio ACP
-// JSON-RPC transport (assistant/tool_use/tool_result/result), so a caller can
-// switch transports without caring which one produced the event.
-//
-// Live-captured event shapes this maps (opencode 1.2.15, acp --port, SSE
-// frames from GET /global/event during a real session/message round trip):
-//   {payload:{type:'message.part.updated', properties:{part:{type:'text',text,...}}}}
-//   {payload:{type:'message.part.updated', properties:{part:{type:'reasoning',text,...}}}}
-//   {payload:{type:'message.updated', properties:{info:{role,finish,...}}}}
-//   {payload:{type:'session.status', properties:{status:{type:'busy'|'idle'}}}}
-//   {payload:{type:'session.idle', properties:{...}}}
-
-function normalizePart(part, sessionId) {
-  if (!part || typeof part !== 'object') return null;
-  // A text part streams in incrementally - the first frame for it can arrive
-  // with an empty string before content lands (live-observed). An empty
-  // chunk carries nothing a caller can render; drop it rather than emitting
-  // a blank assistant bubble.
-  if (part.type === 'text' && typeof part.text === 'string' && part.text.length > 0) {
-    return { type: 'assistant', message: { role: 'assistant', content: [{ type: 'text', text: part.text }] }, session_id: sessionId };
-  }
-  if (part.type === 'tool' || part.type === 'tool-invocation') {
-    return {
-      type: 'assistant',
-      message: { role: 'assistant', content: [{ type: 'tool_use', id: part.id, name: part.tool || part.name || 'tool', input: part.input || part.args || {} }] },
-      session_id: sessionId,
-    };
-  }
-  // reasoning/step-start/step-finish parts carry no user-facing content in
-  // agentgui's chat surface today - dropped (return null), same as the stdio
-  // path drops ACP updates it doesn't recognize.
-  return null;
-}
-
-// A `message.part.updated` frame's `part` carries NO role of its own - live
-// capture confirmed the part's role lives on the earlier `message.updated`
-// frame for the SAME messageID (the prompt echo arrives as a role:"user"
-// message.updated immediately before its own message.part.updated). Each
-// createACPHttpProtocolHandler() call keeps its own messageId->role map so a
-// caller with one handler per session never leaks state across sessions.
-export function createACPHttpProtocolHandler() {
-  const roleByMessageId = new Map();
-
-  return function (frame, context) {
-    if (!frame || typeof frame !== 'object') return null;
-    const payload = frame.payload;
-    if (!payload || typeof payload !== 'object') return null;
-    const sid = context?.sessionId;
-
-    if (payload.type === 'message.updated') {
-      const info = payload.properties?.info;
-      if (!info) return null;
-      if (info.id) roleByMessageId.set(info.id, info.role);
-      if (info.role === 'assistant' && info.finish) {
-        return { type: 'result', result: '', stopReason: info.finish, usage: info.tokens ? { used: info.tokens.total } : undefined, session_id: info.sessionID || sid };
-      }
-      return null;
-    }
-
-    if (payload.type === 'message.part.updated') {
-      const part = payload.properties?.part;
-      if (!part) return null;
-      // The user's own prompt echoes back as a part on their own message -
-      // only forward parts belonging to an assistant-role message.
-      const role = part.messageID ? roleByMessageId.get(part.messageID) : undefined;
-      if (role === 'user') return null;
-      return normalizePart(part, sid);
-    }
-
-    if (payload.type === 'session.status' && payload.properties?.status?.type === 'error') {
-      return { type: 'error', error: payload.properties.status };
-    }
-
-    return null;
-  };
-}
-
-export const acpHttpProtocolHandler = createACPHttpProtocolHandler();
-
-// Parse one SSE "data: {...}\n\n" frame (or a raw chunk containing several)
-// into an array of parsed JSON payloads. opencode's /global/event stream
-// uses the standard `data: <json>\n\n` SSE framing (live-confirmed).
-export function parseSSEChunk(chunk) {
-  const out = [];
-  for (const block of chunk.split('\n\n')) {
-    const line = block.trim();
-    if (!line.startsWith('data:')) continue;
-    const jsonText = line.slice(5).trim();
-    if (!jsonText) continue;
-    try { out.push(JSON.parse(jsonText)); } catch { /* partial frame, skip */ }
-  }
-  return out;
-}

package/lib/http-routes/mutations.js

@@ -1,199 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import crypto from 'crypto';
-import {
-  confineToRoots, fsAllowRoots, sanitizeEntryName, safeErrMsg, readBody,
-  isAllowRoot, moveToTrash, restoreFromTrash, SECRET_RE,
-} from './shared.js';
-
-// --- File mutations ----------------------------------------------------
-// The Files surface is a real manager (fsbrowse-grade): rename, delete,
-// mkdir, upload. Every route re-confines via confineToRoots (realpath, so
-// a symlink inside a root cannot point a mutation outside it), refuses
-// the roots themselves as targets, and sanitizes any NEW name to a single
-// path component (sanitizeEntryName). All are POST/PUT-only with JSON or
-// raw-byte bodies; errors map to plain machine codes the client renders
-// as human copy.
-
-// POST /api/rename {path, newName} -> {ok, path}
-export async function handleRename(req, res, sendJSON) {
-  let body;
-  try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
-  catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
-  const allowRoots = fsAllowRoots();
-  const conf = confineToRoots(String(body.path || ''), allowRoots);
-  if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
-  if (isAllowRoot(conf.realPath, allowRoots)) { sendJSON(req, res, 403, { error: 'forbidden: cannot rename an allowed root' }); return; }
-  const newName = sanitizeEntryName(body.newName);
-  if (!newName) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
-  if (SECRET_RE.test(newName)) { sendJSON(req, res, 403, { error: 'forbidden: secret/dotfile name' }); return; }
-  const target = path.join(path.dirname(conf.realPath), newName);
-  // The target stays in the same (already-confined) directory by
-  // construction, but re-check anyway so the invariant is local.
-  const tConf = confineToRoots(path.dirname(target), allowRoots);
-  if (!tConf.ok) { sendJSON(req, res, 403, { error: 'forbidden: target outside allowed roots' }); return; }
-  if (fs.existsSync(target)) { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
-  try { fs.renameSync(conf.realPath, target); sendJSON(req, res, 200, { ok: true, path: target }); }
-  catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: safeErrMsg(err) }); }
-}
-
-// POST /api/move {path, destDir, overwrite?} -> {ok, path}. Moves an
-// entry into another directory; BOTH endpoints re-confine via realpath.
-// Refuses: a root as the source, a directory moved into itself or its
-// own subtree, and an existing target unless overwrite:true (and never
-// overwrites a directory).
-export async function handleMove(req, res, sendJSON) {
-  let body;
-  try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
-  catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
-  const allowRoots = fsAllowRoots();
-  const conf = confineToRoots(String(body.path || ''), allowRoots);
-  if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
-  if (isAllowRoot(conf.realPath, allowRoots)) { sendJSON(req, res, 403, { error: 'forbidden: cannot move an allowed root' }); return; }
-  const dConf = confineToRoots(String(body.destDir || ''), allowRoots);
-  if (!dConf.ok) { sendJSON(req, res, dConf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + dConf.reason }); return; }
-  let destIsDir = false;
-  try { destIsDir = fs.statSync(dConf.realPath).isDirectory(); } catch {}
-  if (!destIsDir) { sendJSON(req, res, 400, { error: 'destination is not a directory' }); return; }
-  const name = sanitizeEntryName(path.basename(conf.realPath));
-  if (!name) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
-  // A directory must never move into itself or its own subtree.
-  const srcPrefix = conf.realPath + path.sep;
-  if (dConf.realPath === conf.realPath || dConf.realPath.startsWith(srcPrefix)) {
-    sendJSON(req, res, 400, { error: 'cannot move a folder into itself' }); return;
-  }
-  const target = path.join(dConf.realPath, name);
-  if (target === conf.realPath) { sendJSON(req, res, 200, { ok: true, path: target }); return; }
-  if (fs.existsSync(target)) {
-    let targetIsDir = false;
-    try { targetIsDir = fs.lstatSync(target).isDirectory(); } catch {}
-    if (targetIsDir || body.overwrite !== true) {
-      sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return;
-    }
-  }
-  try { fs.renameSync(conf.realPath, target); sendJSON(req, res, 200, { ok: true, path: target }); }
-  catch (err) {
-    const code = err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400;
-    sendJSON(req, res, code, { error: err.code === 'EXDEV' ? 'cannot move across drives' : err.message });
-  }
-}
-
-// POST /api/delete {path, recursive?} -> {ok}. Deleting a non-empty dir
-// requires recursive:true (the client confirms first).
-export async function handleDelete(req, res, sendJSON) {
-  let body;
-  try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
-  catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
-  const allowRoots = fsAllowRoots();
-  const conf = confineToRoots(String(body.path || ''), allowRoots);
-  if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
-  if (isAllowRoot(conf.realPath, allowRoots)) { sendJSON(req, res, 403, { error: 'forbidden: cannot delete an allowed root' }); return; }
-  try {
-    const st = fs.lstatSync(conf.realPath);
-    // Soft-delete: move into a confined per-root .agentgui-trash/ instead
-    // of unlinking, so the only safety net isn't confirm-before (the
-    // pre-existing ConfirmDialog) but also undo-after, matching an
-    // fsbrowse-grade file manager. A non-empty directory without
-    // recursive=true still throws ENOTEMPTY BEFORE any move happens
-    // (checked via a dry probe) to keep that existing guard's semantics.
-    if (st.isDirectory() && body.recursive !== true) {
-      const dryEntries = fs.readdirSync(conf.realPath);
-      if (dryEntries.length) { sendJSON(req, res, 409, { error: 'directory is not empty' }); return; }
-    }
-    const trashInfo = moveToTrash(conf.realPath, allowRoots);
-    sendJSON(req, res, 200, { ok: true, trashId: trashInfo.trashId });
-  } catch (err) {
-    const code = err.code === 'ENOTEMPTY' ? 409 : (err.code === 'EACCES' || err.code === 'EPERM' ? 403 : (err.code === 'ENOENT' ? 404 : 400));
-    sendJSON(req, res, code, { error: err.code === 'ENOTEMPTY' ? 'directory is not empty' : err.message });
-  }
-}
-
-// POST /api/restore {trashId} -> {ok, path}. Undoes a /api/delete within
-// its retention window (trashRetentionMs, default 10 minutes) by moving
-// the entry back from .agentgui-trash/ to its original confined path.
-export async function handleRestore(req, res, sendJSON) {
-  let body;
-  try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
-  catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
-  try {
-    const restored = restoreFromTrash(String(body.trashId || ''), fsAllowRoots());
-    sendJSON(req, res, 200, { ok: true, path: restored.path });
-  } catch (err) {
-    sendJSON(req, res, err.code === 'NOT_FOUND' ? 404 : (err.code === 'CONFLICT' ? 409 : 400), { error: err.message });
-  }
-}
-
-// POST /api/mkdir {dir, name} -> {ok, path}. dir must exist inside roots.
-export async function handleMkdir(req, res, sendJSON) {
-  let body;
-  try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
-  catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
-  const allowRoots = fsAllowRoots();
-  const conf = confineToRoots(String(body.dir || ''), allowRoots);
-  if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
-  const name = sanitizeEntryName(body.name);
-  if (!name) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
-  if (SECRET_RE.test(name)) { sendJSON(req, res, 403, { error: 'forbidden: secret/dotfile name' }); return; }
-  const target = path.join(conf.realPath, name);
-  if (fs.existsSync(target)) { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
-  try { fs.mkdirSync(target); sendJSON(req, res, 200, { ok: true, path: target }); }
-  catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
-}
-
-// PUT /api/upload-file?dir=<enc>&name=<enc> with raw file bytes as the
-// body (no multipart dependency; the client sends fetch(file)). 50MB cap,
-// never overwrites unless ?overwrite=1. Distinct path from the legacy
-// express-mounted /api/upload/:conversationId.
-export async function handleUploadFile(req, res, sendJSON) {
-  let qs;
-  try { qs = new URL(req.url, 'http://localhost').searchParams; } catch { qs = new URLSearchParams(); }
-  // Require Content-Length header: rejects chunked or missing-length requests
-  // that could claim any size. Pre-validates the announced size before streaming.
-  const contentLength = req.headers['content-length'];
-  if (!contentLength) {
-    sendJSON(req, res, 411, { error: 'length required' }); return;
-  }
-  const MAX_UPLOAD = 50 * 1024 * 1024;
-  const len = parseInt(contentLength, 10);
-  if (isNaN(len) || len < 0 || len > MAX_UPLOAD) {
-    sendJSON(req, res, 413, { error: `file too large (max ${MAX_UPLOAD} bytes)` }); return;
-  }
-  const allowRoots = fsAllowRoots();
-  const conf = confineToRoots(qs.get('dir') || '', allowRoots);
-  if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
-  const name = sanitizeEntryName(qs.get('name'));
-  if (!name) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
-  if (SECRET_RE.test(name)) { sendJSON(req, res, 403, { error: 'forbidden: secret/dotfile name' }); return; }
-  const target = path.join(conf.realPath, name);
-  if (fs.existsSync(target) && qs.get('overwrite') !== '1') { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
-  // Stream the upload body to a temp file to keep memory constant and
-  // avoid blocking the event loop with a large synchronous writeFileSync.
-  const tmpPath = target + '.tmp.' + crypto.randomBytes(6).toString('hex');
-  try {
-    await new Promise((resolve, reject) => {
-      const ws = fs.createWriteStream(tmpPath);
-      let total = 0;
-      ws.on('error', reject);
-      req.on('error', reject);
-      req.on('data', (chunk) => {
-        total += chunk.length;
-        if (total > MAX_UPLOAD) {
-          ws.destroy();
-          req.destroy();
-          const e = new Error('file too large (50MB cap)'); e.code = 'TOO_LARGE';
-          reject(e); return;
-        }
-        ws.write(chunk);
-      });
-      req.on('end', () => ws.end());
-      ws.on('finish', () => resolve(total));
-    });
-    fs.renameSync(tmpPath, target);
-    const uploadedSize = fs.statSync(target).size;
-    sendJSON(req, res, 200, { ok: true, path: target, size: uploadedSize });
-  } catch (err) {
-    try { fs.unlinkSync(tmpPath); } catch (_) {}
-    if (err.code === 'TOO_LARGE') { sendJSON(req, res, 413, { error: 'file too large (50MB cap)' }); return; }
-    sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: 'upload failed' });
-  }
-}

package/lib/http-routes/reads.js

@@ -1,212 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
-import {
-  confineToRoots, fsAllowRoots, resolveConfinedPath, safeErrMsg, SECRET_RE,
-} from './shared.js';
-
-// Existence/shape probe for a proposed chat working directory, confined
-// to the same allowlist as the Files surface (an unconfined stat would be
-// a filesystem oracle). Returns {ok, dir} or a 403/404 with plain copy.
-export function handleStat(req, res, routePath, sendJSON) {
-  const decodedPath = resolveConfinedPath(req, routePath, 'path', '/api/stat');
-  const conf = confineToRoots(decodedPath, fsAllowRoots());
-  if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: conf.reason }); return; }
-  try {
-    const st = fs.statSync(conf.realPath);
-    sendJSON(req, res, 200, { ok: true, dir: st.isDirectory(), path: conf.realPath });
-  } catch (err) {
-    sendJSON(req, res, err.code === 'ENOENT' ? 404 : 403, { error: safeErrMsg(err) });
-  }
-}
-
-// Directory listing for the Files / folder-browser view (mirrors fsbrowse
-// /api/list). Confined to an allowlist root exactly like /api/image - the
-// normalize-then-prefix-check is the real guard (a `..` test after
-// path.normalize is a no-op). Returns {path, segments, entries} so the kit
-// FileGrid + BreadcrumbPath render directly. Allowed roots default to the
-// server cwd + Claude projects dir; widen via FS_ROOTS (path-separated).
-export function handleList(req, res, routePath, sendJSON) {
-  const decodedPath = resolveConfinedPath(req, routePath, 'dir', '/api/list');
-  const allowRoots = fsAllowRoots();
-  // Empty path = the first allow-root (a sane default landing dir).
-  const reqPath = !decodedPath ? allowRoots[0] : decodedPath;
-  const conf = confineToRoots(reqPath, allowRoots);
-  if (!conf.ok) {
-    const code = conf.reason === 'not found' ? 404 : 403;
-    sendJSON(req, res, code, { error: 'forbidden: ' + conf.reason }); return;
-  }
-  // Use the symlink-resolved real path for all reads.
-  const normalizedPath = conf.realPath;
-  try {
-    const st = fs.statSync(normalizedPath);
-    if (!st.isDirectory()) { sendJSON(req, res, 400, { error: 'not a directory' }); return; }
-    // Classify by extension into the kit's data-file-type buckets so
-    // FileGrid renders the right rail/icon. dir/symlink come from stat.
-    const EXT_TYPE = {
-      image: ['png','jpg','jpeg','gif','webp','svg','bmp','ico','avif'],
-      video: ['mp4','webm','mov','mkv','avi','m4v'],
-      audio: ['mp3','wav','ogg','flac','m4a','aac'],
-      code: ['js','mjs','cjs','ts','tsx','jsx','rs','go','py','rb','java','c','cpp','h','hpp','cs','php','sh','css','html','json','yml','yaml','toml','sql'],
-      text: ['txt','md','log','csv','env'],
-      archive: ['zip','tar','gz','tgz','rar','7z','bz2','xz'],
-      document: ['pdf','doc','docx','xls','xlsx','ppt','pptx','odt'],
-    };
-    const typeFor = (name, dirent) => {
-      if (dirent.isSymbolicLink()) return 'symlink';
-      if (dirent.isDirectory()) return 'dir';
-      const ext = path.extname(name).slice(1).toLowerCase();
-      for (const [t, exts] of Object.entries(EXT_TYPE)) if (exts.includes(ext)) return t;
-      return 'other';
-    };
-    const dirents = fs.readdirSync(normalizedPath, { withFileTypes: true }).filter((d) => !SECRET_RE.test(d.name));
-    const entries = dirents.map((d) => {
-      const full = path.join(normalizedPath, d.name);
-      let size = null, modified = null, permissions;
-      try {
-        const s = fs.statSync(full); size = s.isDirectory() ? null : s.size; modified = s.mtime.toISOString();
-        // Per-entry permission probe (mirrors fsbrowse checkPermissions) so
-        // the row reads honestly (read-only / no access) instead of a silent
-        // size:null on a stat failure. A stat success means at least read.
-        const perms = ['read'];
-        try { fs.accessSync(full, fs.constants.W_OK); perms.push('write'); } catch (_) {}
-        permissions = perms;
-      } catch (e) {
-        // Could not stat (commonly EACCES): mark no-access so the client
-        // disables open + shows the tag, rather than failing silently.
-        permissions = e && e.code === 'EACCES' ? 'EACCES' : [];
-      }
-      return { name: d.name, type: typeFor(d.name, d), size, modified, path: full, permissions };
-    }).sort((a, b) => (a.type === 'dir' ? 0 : 1) - (b.type === 'dir' ? 0 : 1) || a.name.localeCompare(b.name));
-    // Breadcrumb segments from the absolute path (drive/root aware).
-    const segments = normalizedPath.split(/[\\\/]+/).filter(Boolean);
-    sendJSON(req, res, 200, { path: normalizedPath, segments, entries, roots: allowRoots });
-  } catch (err) {
-    const code = err && err.code === 'ENOENT' ? 404 : (err && err.code === 'EACCES' ? 403 : 400);
-    sendJSON(req, res, code, { error: safeErrMsg(err) });
-  }
-}
-
-// Raw file bytes for the Files preview pane. Confined to the SAME
-// allowlist roots as /api/list (server cwd + Claude projects dir, widened
-// via FS_ROOTS). Same normalize-then-prefix-check guard. Capped at 512KB
-// and limited to reasonable text/code/image types so this is never a
-// generic arbitrary-file reader. Images are served via /api/image; this
-// returns text/* with utf-8.
-export function handleFile(req, res, routePath) {
-  const decodedPath = resolveConfinedPath(req, routePath, 'path', '/api/file/');
-  const allowRoots = fsAllowRoots();
-  const conf = confineToRoots(decodedPath, allowRoots);
-  if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end('Forbidden'); return; }
-  const normalizedPath = conf.realPath;
-  // Block secret-bearing files regardless of root: dotfiles, env/key/cert
-  // material, and credential stores must never be readable through the
-  // Files preview even when they sit inside an allowed root.
-  const base = path.basename(normalizedPath);
-  if (SECRET_RE.test(base)) { res.writeHead(403); res.end('Forbidden'); return; }
-  // Only known text/code extensions (images go through /api/image). An
-  // unknown/binary extension is rejected, never served as octet-stream.
-  // env/conf/cfg/ini are dropped - they commonly carry secrets.
-  const TEXT_EXTS = new Set([
-    'js','mjs','cjs','ts','tsx','jsx','rs','go','py','rb','java','c','cpp','h','hpp','cs','php','sh','css','html','json','yml','yaml','toml','sql',
-    'txt','md','log','csv','xml','gitignore','dockerfile','svg',
-  ]);
-  const ext = path.extname(normalizedPath).slice(1).toLowerCase()
-    || path.basename(normalizedPath).toLowerCase();
-  if (!TEXT_EXTS.has(ext)) { res.writeHead(403); res.end('Forbidden: unsupported type'); return; }
-  try {
-    const st = fs.statSync(normalizedPath);
-    if (!st.isFile()) { res.writeHead(400); res.end('Not a file'); return; }
-    const MAX = 512 * 1024;
-    const fd = fs.openSync(normalizedPath, 'r');
-    const len = Math.min(st.size, MAX);
-    const buf = Buffer.alloc(len);
-    fs.readSync(fd, buf, 0, len, 0);
-    fs.closeSync(fd);
-    res.writeHead(200, {
-      'Content-Type': 'text/plain; charset=utf-8',
-      'Cache-Control': 'no-cache',
-      'X-File-Truncated': st.size > MAX ? '1' : '0',
-    });
-    res.end(buf);
-  } catch (err) {
-    const code = err && err.code === 'ENOENT' ? 404 : (err && err.code === 'EACCES' ? 403 : 400);
-    res.writeHead(code); res.end(safeErrMsg(err));
-  }
-}
-
-// Confined raw-bytes download (any type) with an attachment disposition,
-// so the Files view can offer download on a row. Same allowlist + realpath
-// confinement as /api/file and /api/image - never a generic file reader.
-export function handleDownload(req, res, routePath) {
-  const decodedPath = resolveConfinedPath(req, routePath, 'path', '/api/download/');
-  const allowRoots = fsAllowRoots();
-  const conf = confineToRoots(decodedPath, allowRoots);
-  if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end('Forbidden'); return; }
-  const normalizedPath = conf.realPath;
-  // Same secret-name block as /api/file: a download must not exfiltrate
-  // .env/.pem/.key/credential material just because it streams bytes.
-  if (SECRET_RE.test(path.basename(normalizedPath))) { res.writeHead(403); res.end('Forbidden'); return; }
-  try {
-    const st = fs.statSync(normalizedPath);
-    if (!st.isFile()) { res.writeHead(400); res.end('Not a file'); return; }
-    const MAX = 50 * 1024 * 1024; // 50MB cap so a download can't exhaust memory
-    if (st.size > MAX) { res.writeHead(413); res.end('File too large to download'); return; }
-    const base = path.basename(normalizedPath);
-    const asciiName = base.replace(/[\\"\r\n]/g, '').replace(/[^\x20-\x7e]/g, '_');
-    res.writeHead(200, {
-      'Content-Type': 'application/octet-stream',
-      'Content-Disposition': 'attachment; filename="' + asciiName + '"; filename*=UTF-8\'\'' + encodeURIComponent(base),
-      'Content-Length': String(st.size),
-      'Cache-Control': 'no-cache',
-    });
-    const rs = fs.createReadStream(normalizedPath);
-    rs.on('error', (streamErr) => { if (!res.writableEnded) res.destroy(streamErr); });
-    rs.pipe(res);
-  } catch (err) {
-    const code = err && err.code === 'ENOENT' ? 404 : (err && err.code === 'EACCES' ? 403 : 400);
-    res.writeHead(code); res.end(safeErrMsg(err));
-  }
-}
-
-// Confined image bytes with a content-type allowlist (SVG intentionally
-// excluded - see inline comment below). Its own allowlist roots (Claude
-// projects dir + IMAGE_ROOTS), distinct from fsAllowRoots(), because the
-// user home is never a default root for arbitrary image reads.
-export function handleImage(req, res, routePath, sendJSON) {
-  const decodedPath = resolveConfinedPath(req, routePath, 'path', '/api/image/');
-  // Confine reads to an allowlist root. Without this the route is an
-  // arbitrary-file-read of any image-extensioned path on the host (the
-  // prior `includes('..')` guard is a no-op after path.normalize resolves
-  // the segments). Allowed roots: the Claude projects dir (history images)
-  // only; add more via IMAGE_ROOTS (path-separated). The user home is NOT
-  // a default root - it covers ~/.ssh, ~/.aws, dotfiles etc., so an image
-  // route reaching all of home is a broad read of anything image-shaped.
-  // confineToRoots also realpath-resolves so a symlink inside a root can't
-  // point an image read at an out-of-root file.
-  const allowRoots = [
-    process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
-    ...(process.env.IMAGE_ROOTS ? process.env.IMAGE_ROOTS.split(path.delimiter) : []),
-  ].map(r => path.normalize(r));
-  const conf = confineToRoots(decodedPath, allowRoots);
-  if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end(conf.reason === 'not found' ? 'Not found' : 'Forbidden'); return; }
-  const normalizedPath = conf.realPath;
-  try {
-    const ext = path.extname(normalizedPath).toLowerCase();
-    const mimeTypes = { '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.webp': 'image/webp' };
-    // SVG is intentionally excluded: browsers render SVG as a live document
-    // in the app's origin, so an agent-written SVG with a <script src=CDN>
-    // would execute in the agentgui origin (CSP allows unpkg/jsdelivr).
-    // Files preview uses /api/file/download (attachment) for SVG.
-    const contentType = mimeTypes[ext];
-    if (!contentType) { res.writeHead(403); res.end('Forbidden'); return; }
-    const imgSt = fs.statSync(normalizedPath);
-    const IMG_MAX = 20 * 1024 * 1024; // 20MB hard cap
-    if (imgSt.size > IMG_MAX) { res.writeHead(413); res.end('Image too large'); return; }
-    // Always stream to avoid blocking the event loop on large synchronous reads.
-    res.writeHead(200, { 'Content-Type': contentType, 'Cache-Control': 'no-cache', 'Content-Length': String(imgSt.size) });
-    const imgRs = fs.createReadStream(normalizedPath);
-    imgRs.on('error', (streamErr) => { if (!res.writableEnded) res.destroy(streamErr); });
-    imgRs.pipe(res);
-  } catch (err) { sendJSON(req, res, 400, { error: 'cannot read image' }); }
-}