agentgui 1.0.958 → 1.0.959

package/lib/http-handler.js

@@ -37,6 +37,56 @@ function confineToRoots(inputPath, allowRoots) {
   return { ok: true, realPath };
 }
 
+// The allowlist the Files surface operates within: server cwd + Claude
+// projects dir, widened via FS_ROOTS (path-separated). One construction so
+// /api/list,file,download and the mutation routes can never drift apart.
+function fsAllowRoots() {
+  return [
+    process.env.STARTUP_CWD || process.cwd(),
+    process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
+    ...(process.env.FS_ROOTS ? process.env.FS_ROOTS.split(path.delimiter) : []),
+  ].map(r => path.normalize(r));
+}
+
+// A new file/dir name must be a single path component: no separators, no
+// traversal, no NTFS alternate-data-stream colon, no reserved Windows device
+// names, no trailing dot/space (Windows silently strips them, aliasing two
+// names onto one entry). Returns the trimmed name or null when inadmissible.
+function sanitizeEntryName(name) {
+  if (typeof name !== 'string') return null;
+  const n = name.trim();
+  if (!n || n.length > 255) return null;
+  if (/[\\/:*?"<>|\x00-\x1f]/.test(n)) return null;
+  if (n === '.' || n === '..') return null;
+  if (/[. ]$/.test(n)) return null;
+  if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(n)) return null;
+  return n;
+}
+
+// Read a request body with a hard size cap; resolves a Buffer or rejects with
+// .code='TOO_LARGE' so the caller can answer 413 without buffering the rest.
+function readBody(req, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = []; let total = 0;
+    req.on('data', (c) => {
+      total += c.length;
+      if (total > maxBytes) { const e = new Error('body too large'); e.code = 'TOO_LARGE'; req.destroy(); reject(e); return; }
+      chunks.push(c);
+    });
+    req.on('end', () => resolve(Buffer.concat(chunks)));
+    req.on('error', reject);
+  });
+}
+
+// True when the resolved path IS one of the allowlist roots - the roots
+// themselves are never mutation targets (rename/delete of a root would orphan
+// the whole surface).
+function isAllowRoot(realPath, allowRoots) {
+  const isWindows = os.platform() === 'win32';
+  const p = isWindows ? realPath.toLowerCase() : realPath;
+  return allowRoots.some(r => (isWindows ? r.toLowerCase() : r) === p);
+}
+
 export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, serveFile, staticDir, messageQueues, getWss, activeExecutions, getACPStatus, discoveredAgents, PKG_VERSION, RATE_LIMIT_MAX, rateLimitMap, routes, PORT }) {
   return async function httpHandler(req, res) {
     // CORS: when PASSWORD is set the server holds credentials a cross-origin
@@ -116,6 +166,28 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
     }
 
     const pathOnly = req.url.split('?')[0];
+
+    // CSRF guard on every state-changing method. Without PASSWORD the server
+    // is open and advertises a wildcard ACAO, so a cross-site page could POST
+    // a form at the mutation routes (rename/delete/mkdir/upload) on localhost.
+    // A simple cross-site form cannot set Sec-Fetch-Site:same-origin, send
+    // application/json, or attach custom headers - so: accept when the
+    // browser says same-origin/none (direct nav, same-origin fetch), when the
+    // body is declared JSON, or when an Authorization header rode along (a
+    // credentialed programmatic client). Reject the rest with 403.
+    if (req.method === 'POST' || req.method === 'PUT' || req.method === 'DELETE') {
+      const sfs = req.headers['sec-fetch-site'];
+      const ct = (req.headers['content-type'] || '').toLowerCase();
+      const sameSite = !sfs || sfs === 'same-origin' || sfs === 'none';
+      const jsonBody = ct.startsWith('application/json') || ct.startsWith('application/octet-stream') || ct === '';
+      const authed = !!req.headers['authorization'];
+      if (!sameSite && !jsonBody && !authed) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'cross-site request rejected' }));
+        return;
+      }
+    }
+
     if (pathOnly.startsWith(BASE_URL + '/api/upload/') || pathOnly.startsWith(BASE_URL + '/files/') || pathOnly.startsWith('/v1/history') || (BASE_URL && pathOnly.startsWith(BASE_URL + '/v1/history'))) return expressApp(req, res);
 
     if (req.url === '/favicon.ico' || req.url === BASE_URL + '/favicon.ico') {
@@ -147,7 +219,31 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         try { queries._db.prepare('SELECT 1').get(); } catch (e) { dbStatus = { ok: false, error: e.message }; }
         const queueSizes = {};
         for (const [k, v] of messageQueues) queueSizes[k] = v.length;
-        sendJSON(req, res, 200, { status: 'ok', version: PKG_VERSION, uptime: process.uptime(), agents: discoveredAgents.length, activeExecutions: activeExecutions.size, wsClients: getWss()?.clients?.size ?? 0, memory: process.memoryUsage(), acp: getACPStatus(), db: dbStatus, queueSizes });
+        sendJSON(req, res, 200, {
+          status: 'ok', version: PKG_VERSION, uptime: process.uptime(), agents: discoveredAgents.length,
+          activeExecutions: activeExecutions.size, wsClients: getWss()?.clients?.size ?? 0,
+          memory: process.memoryUsage(), acp: getACPStatus(), db: dbStatus, queueSizes,
+          // Read-only server facts for the settings server-info panel.
+          projectsDir: process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
+          allowRoots: fsAllowRoots(),
+        });
+        return;
+      }
+
+      // Existence/shape probe for a proposed chat working directory, confined
+      // to the same allowlist as the Files surface (an unconfined stat would be
+      // a filesystem oracle). Returns {ok, dir} or a 403/404 with plain copy.
+      if (routePath.startsWith('/api/stat') && req.method === 'GET') {
+        const rawS = routePath.split('?')[0].slice('/api/stat'.length).replace(/^\//, '');
+        const decodedPath = rawS ? decodeURIComponent(rawS) : '';
+        const conf = confineToRoots(decodedPath, fsAllowRoots());
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: conf.reason }); return; }
+        try {
+          const st = fs.statSync(conf.realPath);
+          sendJSON(req, res, 200, { ok: true, dir: st.isDirectory(), path: conf.realPath });
+        } catch (err) {
+          sendJSON(req, res, err.code === 'ENOENT' ? 404 : 403, { error: err.message });
+        }
         return;
       }
 
@@ -191,11 +287,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       if (routePath.startsWith('/api/list')) {
         const rawQ = routePath.split('?')[0].slice('/api/list'.length).replace(/^\//, '');
         const decodedPath = rawQ ? decodeURIComponent(rawQ) : '';
-        const allowRoots = [
-          process.env.STARTUP_CWD || process.cwd(),
-          process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
-          ...(process.env.FS_ROOTS ? process.env.FS_ROOTS.split(path.delimiter) : []),
-        ].map(r => path.normalize(r));
+        const allowRoots = fsAllowRoots();
         // Empty path = the first allow-root (a sane default landing dir).
         const reqPath = !decodedPath ? allowRoots[0] : decodedPath;
         const conf = confineToRoots(reqPath, allowRoots);
@@ -264,11 +356,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       if (routePath.startsWith('/api/file/')) {
         const rawF = routePath.split('?')[0].slice('/api/file/'.length);
         const decodedPath = decodeURIComponent(rawF);
-        const allowRoots = [
-          process.env.STARTUP_CWD || process.cwd(),
-          process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
-          ...(process.env.FS_ROOTS ? process.env.FS_ROOTS.split(path.delimiter) : []),
-        ].map(r => path.normalize(r));
+        const allowRoots = fsAllowRoots();
         const conf = confineToRoots(decodedPath, allowRoots);
         if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end('Forbidden'); return; }
         const normalizedPath = conf.realPath;
@@ -309,11 +397,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       if (routePath.startsWith('/api/download/')) {
         const rawD = routePath.split('?')[0].slice('/api/download/'.length);
         const decodedPath = decodeURIComponent(rawD);
-        const allowRoots = [
-          process.env.STARTUP_CWD || process.cwd(),
-          process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
-          ...(process.env.FS_ROOTS ? process.env.FS_ROOTS.split(path.delimiter) : []),
-        ].map(r => path.normalize(r));
+        const allowRoots = fsAllowRoots();
         const conf = confineToRoots(decodedPath, allowRoots);
         if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end('Forbidden'); return; }
         const normalizedPath = conf.realPath;
@@ -337,6 +421,102 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         return;
       }
 
+      // --- File mutations ----------------------------------------------------
+      // The Files surface is a real manager (fsbrowse-grade): rename, delete,
+      // mkdir, upload. Every route re-confines via confineToRoots (realpath, so
+      // a symlink inside a root cannot point a mutation outside it), refuses
+      // the roots themselves as targets, and sanitizes any NEW name to a single
+      // path component (sanitizeEntryName). All are POST/PUT-only with JSON or
+      // raw-byte bodies; errors map to plain machine codes the client renders
+      // as human copy.
+
+      // POST /api/rename {path, newName} -> {ok, path}
+      if (routePath.split('?')[0] === '/api/rename' && req.method === 'POST') {
+        let body;
+        try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
+        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
+        const allowRoots = fsAllowRoots();
+        const conf = confineToRoots(String(body.path || ''), allowRoots);
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
+        if (isAllowRoot(conf.realPath, allowRoots)) { sendJSON(req, res, 403, { error: 'forbidden: cannot rename an allowed root' }); return; }
+        const newName = sanitizeEntryName(body.newName);
+        if (!newName) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
+        const target = path.join(path.dirname(conf.realPath), newName);
+        // The target stays in the same (already-confined) directory by
+        // construction, but re-check anyway so the invariant is local.
+        const tConf = confineToRoots(path.dirname(target), allowRoots);
+        if (!tConf.ok) { sendJSON(req, res, 403, { error: 'forbidden: target outside allowed roots' }); return; }
+        if (fs.existsSync(target)) { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
+        try { fs.renameSync(conf.realPath, target); sendJSON(req, res, 200, { ok: true, path: target }); }
+        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
+        return;
+      }
+
+      // POST /api/delete {path, recursive?} -> {ok}. Deleting a non-empty dir
+      // requires recursive:true (the client confirms first).
+      if (routePath.split('?')[0] === '/api/delete' && req.method === 'POST') {
+        let body;
+        try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
+        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
+        const allowRoots = fsAllowRoots();
+        const conf = confineToRoots(String(body.path || ''), allowRoots);
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
+        if (isAllowRoot(conf.realPath, allowRoots)) { sendJSON(req, res, 403, { error: 'forbidden: cannot delete an allowed root' }); return; }
+        try {
+          const st = fs.lstatSync(conf.realPath);
+          if (st.isDirectory()) {
+            if (body.recursive === true) fs.rmSync(conf.realPath, { recursive: true });
+            else fs.rmdirSync(conf.realPath); // throws ENOTEMPTY unless empty
+          } else {
+            fs.unlinkSync(conf.realPath);
+          }
+          sendJSON(req, res, 200, { ok: true });
+        } catch (err) {
+          const code = err.code === 'ENOTEMPTY' ? 409 : (err.code === 'EACCES' || err.code === 'EPERM' ? 403 : (err.code === 'ENOENT' ? 404 : 400));
+          sendJSON(req, res, code, { error: err.code === 'ENOTEMPTY' ? 'directory is not empty' : err.message });
+        }
+        return;
+      }
+
+      // POST /api/mkdir {dir, name} -> {ok, path}. dir must exist inside roots.
+      if (routePath.split('?')[0] === '/api/mkdir' && req.method === 'POST') {
+        let body;
+        try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
+        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
+        const allowRoots = fsAllowRoots();
+        const conf = confineToRoots(String(body.dir || ''), allowRoots);
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
+        const name = sanitizeEntryName(body.name);
+        if (!name) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
+        const target = path.join(conf.realPath, name);
+        if (fs.existsSync(target)) { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
+        try { fs.mkdirSync(target); sendJSON(req, res, 200, { ok: true, path: target }); }
+        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
+        return;
+      }
+
+      // PUT /api/upload-file?dir=<enc>&name=<enc> with raw file bytes as the
+      // body (no multipart dependency; the client sends fetch(file)). 50MB cap,
+      // never overwrites unless ?overwrite=1. Distinct path from the legacy
+      // express-mounted /api/upload/:conversationId.
+      if (routePath.split('?')[0] === '/api/upload-file' && req.method === 'PUT') {
+        let qs;
+        try { qs = new URL(req.url, 'http://localhost').searchParams; } catch { qs = new URLSearchParams(); }
+        const allowRoots = fsAllowRoots();
+        const conf = confineToRoots(qs.get('dir') || '', allowRoots);
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
+        const name = sanitizeEntryName(qs.get('name'));
+        if (!name) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
+        const target = path.join(conf.realPath, name);
+        if (fs.existsSync(target) && qs.get('overwrite') !== '1') { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
+        let buf;
+        try { buf = await readBody(req, 50 * 1024 * 1024); }
+        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: e.code === 'TOO_LARGE' ? 'file too large (50MB cap)' : 'upload failed' }); return; }
+        try { fs.writeFileSync(target, buf); sendJSON(req, res, 200, { ok: true, path: target, size: buf.length }); }
+        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
+        return;
+      }
+
       if (routePath.startsWith('/api/image/')) {
         const imagePath = routePath.slice('/api/image/'.length);
         const decodedPath = decodeURIComponent(imagePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.958",
+  "version": "1.0.959",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/scripts/validate-mutations.mjs

@@ -0,0 +1,40 @@
+// Live security validation of the confined file-mutation endpoints.
+// Run with the server up: node scripts/validate-mutations.mjs
+const BASE = process.env.BASE || 'http://localhost:3000';
+const J = { 'Content-Type': 'application/json' };
+const results = [];
+async function post(route, body, headers = J) {
+  const r = await fetch(BASE + route, { method: 'POST', headers, body: typeof body === 'string' ? body : JSON.stringify(body) });
+  return { status: r.status, body: await r.text() };
+}
+async function check(name, expected, actual) {
+  const ok = actual.status === expected;
+  results.push({ name, expected, got: actual.status, ok, body: actual.body.slice(0, 80) });
+}
+const ROOT = 'C:\\dev\\agentgui';
+// security cases
+await check('rename-traversal', 403, await post('/api/rename', { path: ROOT + '\\..\\..\\Windows\\win.ini', newName: 'x.txt' }));
+await check('delete-out-of-roots', 403, await post('/api/delete', { path: 'C:\\Windows\\Temp\\x.txt' }));
+await check('delete-root-refused', 403, await post('/api/delete', { path: ROOT }));
+await check('mkdir-reserved-name', 400, await post('/api/mkdir', { dir: ROOT, name: 'CON' }));
+await check('mkdir-name-with-separator', 400, await post('/api/mkdir', { dir: ROOT, name: 'a/b' }));
+await check('mkdir-name-trailing-dot', 400, await post('/api/mkdir', { dir: ROOT, name: 'evil.' }));
+await check('mkdir-ads-colon', 400, await post('/api/mkdir', { dir: ROOT, name: 'a:b' }));
+await check('csrf-cross-site-form', 403, await post('/api/delete', 'path=x', { 'Content-Type': 'application/x-www-form-urlencoded', 'Sec-Fetch-Site': 'cross-site' }));
+// round trip
+await check('mkdir-ok', 200, await post('/api/mkdir', { dir: ROOT, name: '_wtest' }));
+const up = await fetch(BASE + '/api/upload-file?dir=' + encodeURIComponent(ROOT + '\\_wtest') + '&name=up.txt', { method: 'PUT', body: 'hello upload' });
+results.push({ name: 'upload-ok', expected: 200, got: up.status, ok: up.status === 200 });
+const up2 = await fetch(BASE + '/api/upload-file?dir=' + encodeURIComponent(ROOT + '\\_wtest') + '&name=up.txt', { method: 'PUT', body: 'x' });
+results.push({ name: 'upload-conflict-409', expected: 409, got: up2.status, ok: up2.status === 409 });
+await check('rename-ok', 200, await post('/api/rename', { path: ROOT + '\\_wtest\\up.txt', newName: 'up2.txt' }));
+await check('rename-conflict-409', 409, await post('/api/rename', { path: ROOT + '\\_wtest\\up2.txt', newName: 'up2.txt' }));
+await check('delete-nonempty-no-recursive-409', 409, await post('/api/delete', { path: ROOT + '\\_wtest' }));
+await check('delete-recursive-ok', 200, await post('/api/delete', { path: ROOT + '\\_wtest', recursive: true }));
+const st = await fetch(BASE + '/api/stat/' + encodeURIComponent(ROOT));
+results.push({ name: 'stat-ok', expected: 200, got: st.status, ok: st.status === 200 });
+const st2 = await fetch(BASE + '/api/stat/' + encodeURIComponent('C:\\Windows'));
+results.push({ name: 'stat-outside-403', expected: 403, got: st2.status, ok: st2.status === 403 });
+let fail = 0;
+for (const r of results) { if (!r.ok) fail++; console.log((r.ok ? 'PASS' : 'FAIL') + ' ' + r.name + ' expected=' + r.expected + ' got=' + r.got + (r.ok ? '' : ' body=' + (r.body || ''))); }
+process.exit(fail ? 1 : 0);