agentgui 1.0.958 → 1.0.960

package/lib/http-handler.js

@@ -37,6 +37,56 @@ function confineToRoots(inputPath, allowRoots) {
   return { ok: true, realPath };
 }
 
+// The allowlist the Files surface operates within: server cwd + Claude
+// projects dir, widened via FS_ROOTS (path-separated). One construction so
+// /api/list,file,download and the mutation routes can never drift apart.
+function fsAllowRoots() {
+  return [
+    process.env.STARTUP_CWD || process.cwd(),
+    process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
+    ...(process.env.FS_ROOTS ? process.env.FS_ROOTS.split(path.delimiter) : []),
+  ].map(r => path.normalize(r));
+}
+
+// A new file/dir name must be a single path component: no separators, no
+// traversal, no NTFS alternate-data-stream colon, no reserved Windows device
+// names, no trailing dot/space (Windows silently strips them, aliasing two
+// names onto one entry). Returns the trimmed name or null when inadmissible.
+function sanitizeEntryName(name) {
+  if (typeof name !== 'string') return null;
+  const n = name.trim();
+  if (!n || n.length > 255) return null;
+  if (/[\\/:*?"<>|\x00-\x1f]/.test(n)) return null;
+  if (n === '.' || n === '..') return null;
+  if (/[. ]$/.test(n)) return null;
+  if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(n)) return null;
+  return n;
+}
+
+// Read a request body with a hard size cap; resolves a Buffer or rejects with
+// .code='TOO_LARGE' so the caller can answer 413 without buffering the rest.
+function readBody(req, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = []; let total = 0;
+    req.on('data', (c) => {
+      total += c.length;
+      if (total > maxBytes) { const e = new Error('body too large'); e.code = 'TOO_LARGE'; req.destroy(); reject(e); return; }
+      chunks.push(c);
+    });
+    req.on('end', () => resolve(Buffer.concat(chunks)));
+    req.on('error', reject);
+  });
+}
+
+// True when the resolved path IS one of the allowlist roots - the roots
+// themselves are never mutation targets (rename/delete of a root would orphan
+// the whole surface).
+function isAllowRoot(realPath, allowRoots) {
+  const isWindows = os.platform() === 'win32';
+  const p = isWindows ? realPath.toLowerCase() : realPath;
+  return allowRoots.some(r => (isWindows ? r.toLowerCase() : r) === p);
+}
+
 export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, serveFile, staticDir, messageQueues, getWss, activeExecutions, getACPStatus, discoveredAgents, PKG_VERSION, RATE_LIMIT_MAX, rateLimitMap, routes, PORT }) {
   return async function httpHandler(req, res) {
     // CORS: when PASSWORD is set the server holds credentials a cross-origin
@@ -116,6 +166,28 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
     }
 
     const pathOnly = req.url.split('?')[0];
+
+    // CSRF guard on every state-changing method. Without PASSWORD the server
+    // is open and advertises a wildcard ACAO, so a cross-site page could POST
+    // a form at the mutation routes (rename/delete/mkdir/upload) on localhost.
+    // A simple cross-site form cannot set Sec-Fetch-Site:same-origin, send
+    // application/json, or attach custom headers - so: accept when the
+    // browser says same-origin/none (direct nav, same-origin fetch), when the
+    // body is declared JSON, or when an Authorization header rode along (a
+    // credentialed programmatic client). Reject the rest with 403.
+    if (req.method === 'POST' || req.method === 'PUT' || req.method === 'DELETE') {
+      const sfs = req.headers['sec-fetch-site'];
+      const ct = (req.headers['content-type'] || '').toLowerCase();
+      const sameSite = !sfs || sfs === 'same-origin' || sfs === 'none';
+      const jsonBody = ct.startsWith('application/json') || ct.startsWith('application/octet-stream') || ct === '';
+      const authed = !!req.headers['authorization'];
+      if (!sameSite && !jsonBody && !authed) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'cross-site request rejected' }));
+        return;
+      }
+    }
+
     if (pathOnly.startsWith(BASE_URL + '/api/upload/') || pathOnly.startsWith(BASE_URL + '/files/') || pathOnly.startsWith('/v1/history') || (BASE_URL && pathOnly.startsWith(BASE_URL + '/v1/history'))) return expressApp(req, res);
 
     if (req.url === '/favicon.ico' || req.url === BASE_URL + '/favicon.ico') {
@@ -147,7 +219,31 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         try { queries._db.prepare('SELECT 1').get(); } catch (e) { dbStatus = { ok: false, error: e.message }; }
         const queueSizes = {};
         for (const [k, v] of messageQueues) queueSizes[k] = v.length;
-        sendJSON(req, res, 200, { status: 'ok', version: PKG_VERSION, uptime: process.uptime(), agents: discoveredAgents.length, activeExecutions: activeExecutions.size, wsClients: getWss()?.clients?.size ?? 0, memory: process.memoryUsage(), acp: getACPStatus(), db: dbStatus, queueSizes });
+        sendJSON(req, res, 200, {
+          status: 'ok', version: PKG_VERSION, uptime: process.uptime(), agents: discoveredAgents.length,
+          activeExecutions: activeExecutions.size, wsClients: getWss()?.clients?.size ?? 0,
+          memory: process.memoryUsage(), acp: getACPStatus(), db: dbStatus, queueSizes,
+          // Read-only server facts for the settings server-info panel.
+          projectsDir: process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
+          allowRoots: fsAllowRoots(),
+        });
+        return;
+      }
+
+      // Existence/shape probe for a proposed chat working directory, confined
+      // to the same allowlist as the Files surface (an unconfined stat would be
+      // a filesystem oracle). Returns {ok, dir} or a 403/404 with plain copy.
+      if (routePath.startsWith('/api/stat') && req.method === 'GET') {
+        const rawS = routePath.split('?')[0].slice('/api/stat'.length).replace(/^\//, '');
+        const decodedPath = rawS ? decodeURIComponent(rawS) : '';
+        const conf = confineToRoots(decodedPath, fsAllowRoots());
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: conf.reason }); return; }
+        try {
+          const st = fs.statSync(conf.realPath);
+          sendJSON(req, res, 200, { ok: true, dir: st.isDirectory(), path: conf.realPath });
+        } catch (err) {
+          sendJSON(req, res, err.code === 'ENOENT' ? 404 : 403, { error: err.message });
+        }
         return;
       }
 
@@ -191,11 +287,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       if (routePath.startsWith('/api/list')) {
         const rawQ = routePath.split('?')[0].slice('/api/list'.length).replace(/^\//, '');
         const decodedPath = rawQ ? decodeURIComponent(rawQ) : '';
-        const allowRoots = [
-          process.env.STARTUP_CWD || process.cwd(),
-          process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
-          ...(process.env.FS_ROOTS ? process.env.FS_ROOTS.split(path.delimiter) : []),
-        ].map(r => path.normalize(r));
+        const allowRoots = fsAllowRoots();
         // Empty path = the first allow-root (a sane default landing dir).
         const reqPath = !decodedPath ? allowRoots[0] : decodedPath;
         const conf = confineToRoots(reqPath, allowRoots);
@@ -264,11 +356,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       if (routePath.startsWith('/api/file/')) {
         const rawF = routePath.split('?')[0].slice('/api/file/'.length);
         const decodedPath = decodeURIComponent(rawF);
-        const allowRoots = [
-          process.env.STARTUP_CWD || process.cwd(),
-          process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
-          ...(process.env.FS_ROOTS ? process.env.FS_ROOTS.split(path.delimiter) : []),
-        ].map(r => path.normalize(r));
+        const allowRoots = fsAllowRoots();
         const conf = confineToRoots(decodedPath, allowRoots);
         if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end('Forbidden'); return; }
         const normalizedPath = conf.realPath;
@@ -309,11 +397,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       if (routePath.startsWith('/api/download/')) {
         const rawD = routePath.split('?')[0].slice('/api/download/'.length);
         const decodedPath = decodeURIComponent(rawD);
-        const allowRoots = [
-          process.env.STARTUP_CWD || process.cwd(),
-          process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
-          ...(process.env.FS_ROOTS ? process.env.FS_ROOTS.split(path.delimiter) : []),
-        ].map(r => path.normalize(r));
+        const allowRoots = fsAllowRoots();
         const conf = confineToRoots(decodedPath, allowRoots);
         if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end('Forbidden'); return; }
         const normalizedPath = conf.realPath;
@@ -337,6 +421,102 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         return;
       }
 
+      // --- File mutations ----------------------------------------------------
+      // The Files surface is a real manager (fsbrowse-grade): rename, delete,
+      // mkdir, upload. Every route re-confines via confineToRoots (realpath, so
+      // a symlink inside a root cannot point a mutation outside it), refuses
+      // the roots themselves as targets, and sanitizes any NEW name to a single
+      // path component (sanitizeEntryName). All are POST/PUT-only with JSON or
+      // raw-byte bodies; errors map to plain machine codes the client renders
+      // as human copy.
+
+      // POST /api/rename {path, newName} -> {ok, path}
+      if (routePath.split('?')[0] === '/api/rename' && req.method === 'POST') {
+        let body;
+        try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
+        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
+        const allowRoots = fsAllowRoots();
+        const conf = confineToRoots(String(body.path || ''), allowRoots);
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
+        if (isAllowRoot(conf.realPath, allowRoots)) { sendJSON(req, res, 403, { error: 'forbidden: cannot rename an allowed root' }); return; }
+        const newName = sanitizeEntryName(body.newName);
+        if (!newName) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
+        const target = path.join(path.dirname(conf.realPath), newName);
+        // The target stays in the same (already-confined) directory by
+        // construction, but re-check anyway so the invariant is local.
+        const tConf = confineToRoots(path.dirname(target), allowRoots);
+        if (!tConf.ok) { sendJSON(req, res, 403, { error: 'forbidden: target outside allowed roots' }); return; }
+        if (fs.existsSync(target)) { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
+        try { fs.renameSync(conf.realPath, target); sendJSON(req, res, 200, { ok: true, path: target }); }
+        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
+        return;
+      }
+
+      // POST /api/delete {path, recursive?} -> {ok}. Deleting a non-empty dir
+      // requires recursive:true (the client confirms first).
+      if (routePath.split('?')[0] === '/api/delete' && req.method === 'POST') {
+        let body;
+        try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
+        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
+        const allowRoots = fsAllowRoots();
+        const conf = confineToRoots(String(body.path || ''), allowRoots);
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
+        if (isAllowRoot(conf.realPath, allowRoots)) { sendJSON(req, res, 403, { error: 'forbidden: cannot delete an allowed root' }); return; }
+        try {
+          const st = fs.lstatSync(conf.realPath);
+          if (st.isDirectory()) {
+            if (body.recursive === true) fs.rmSync(conf.realPath, { recursive: true });
+            else fs.rmdirSync(conf.realPath); // throws ENOTEMPTY unless empty
+          } else {
+            fs.unlinkSync(conf.realPath);
+          }
+          sendJSON(req, res, 200, { ok: true });
+        } catch (err) {
+          const code = err.code === 'ENOTEMPTY' ? 409 : (err.code === 'EACCES' || err.code === 'EPERM' ? 403 : (err.code === 'ENOENT' ? 404 : 400));
+          sendJSON(req, res, code, { error: err.code === 'ENOTEMPTY' ? 'directory is not empty' : err.message });
+        }
+        return;
+      }
+
+      // POST /api/mkdir {dir, name} -> {ok, path}. dir must exist inside roots.
+      if (routePath.split('?')[0] === '/api/mkdir' && req.method === 'POST') {
+        let body;
+        try { body = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}'); }
+        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: 'bad request body' }); return; }
+        const allowRoots = fsAllowRoots();
+        const conf = confineToRoots(String(body.dir || ''), allowRoots);
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
+        const name = sanitizeEntryName(body.name);
+        if (!name) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
+        const target = path.join(conf.realPath, name);
+        if (fs.existsSync(target)) { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
+        try { fs.mkdirSync(target); sendJSON(req, res, 200, { ok: true, path: target }); }
+        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
+        return;
+      }
+
+      // PUT /api/upload-file?dir=<enc>&name=<enc> with raw file bytes as the
+      // body (no multipart dependency; the client sends fetch(file)). 50MB cap,
+      // never overwrites unless ?overwrite=1. Distinct path from the legacy
+      // express-mounted /api/upload/:conversationId.
+      if (routePath.split('?')[0] === '/api/upload-file' && req.method === 'PUT') {
+        let qs;
+        try { qs = new URL(req.url, 'http://localhost').searchParams; } catch { qs = new URLSearchParams(); }
+        const allowRoots = fsAllowRoots();
+        const conf = confineToRoots(qs.get('dir') || '', allowRoots);
+        if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
+        const name = sanitizeEntryName(qs.get('name'));
+        if (!name) { sendJSON(req, res, 400, { error: 'invalid name' }); return; }
+        const target = path.join(conf.realPath, name);
+        if (fs.existsSync(target) && qs.get('overwrite') !== '1') { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
+        let buf;
+        try { buf = await readBody(req, 50 * 1024 * 1024); }
+        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: e.code === 'TOO_LARGE' ? 'file too large (50MB cap)' : 'upload failed' }); return; }
+        try { fs.writeFileSync(target, buf); sendJSON(req, res, 200, { ok: true, path: target, size: buf.length }); }
+        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
+        return;
+      }
+
       if (routePath.startsWith('/api/image/')) {
         const imagePath = routePath.slice('/api/image/'.length);
         const decodedPath = decodeURIComponent(imagePath);

package/lib/ws-handlers-util.js

@@ -18,6 +18,20 @@ const SUB_AGENT_MAP = {
 export function register(router, deps) {
   const { queries, wsOptimizer, broadcastSync, getProviderConfigs, saveProviderConfig, STARTUP_CWD, discoveredAgents, subscriptionIndex, activeChats } = deps;
 
+  // Short-lived per-session terminal-event buffer (finding 35): a turn that
+  // completes/errors/cancels while a client ws is down would otherwise be a
+  // fire-and-forget broadcast the client never sees, hanging it busy forever.
+  // A re-subscribing client gets the buffered terminal frame replayed.
+  const TERMINAL_TTL_MS = 60000;
+  const terminalEvents = new Map(); // sessionId -> terminal event
+  function recordTerminal(sessionId, event) {
+    terminalEvents.set(sessionId, event);
+    const t = setTimeout(() => {
+      if (terminalEvents.get(sessionId) === event) terminalEvents.delete(sessionId);
+    }, TERMINAL_TTL_MS);
+    if (typeof t.unref === 'function') t.unref();
+  }
+
   // --- agents.list: enumerate registered ACP agents + claude-code ---
   router.handle('agents.list', () => {
     const agents = registry.list().map(a => ({
@@ -55,7 +69,11 @@ export function register(router, deps) {
     subscriptionIndex.get(sid).add(ws);
     ws.subscriptions = ws.subscriptions || new Set();
     ws.subscriptions.add(sid);
-    return { subscribed: true, sessionId: sid };
+    // Replay a buffered terminal frame (complete/error/cancelled) so a client
+    // that re-subscribes after a ws drop learns the turn already ended.
+    const term = terminalEvents.get(sid);
+    if (term) { try { wsOptimizer.sendToClient(ws, { ...term, replayed: true }); } catch {} }
+    return { subscribed: true, sessionId: sid, replayedTerminal: !!term };
   });
 
   // --- chat.sendMessage: start a one-shot streaming chat with an agent.
@@ -88,6 +106,9 @@ export function register(router, deps) {
 
     const ctrl = { aborted: false, proc: null, agentId, model, cwd, startedAt: Date.now() };
     activeChats.set(sessionId, ctrl);
+    // Push-driven hint so clients refresh active-session state without
+    // waiting for the 3s chat.active poll (finding 48).
+    broadcastSync({ type: 'chat_active_changed', reason: 'started', sessionId, agentId, timestamp: Date.now() });
 
     // Fire-and-forget. Errors broadcast as streaming_error.
     (async () => {
@@ -127,11 +148,20 @@ export function register(router, deps) {
           onPid: () => {}, onProcess: (proc) => { ctrl.proc = proc; },
         };
         await runClaudeWithStreaming(content, cwd, agentId, config);
-        broadcastSync({ type: 'streaming_complete', sessionId, agentId, eventCount, timestamp: Date.now() });
+        if (!ctrl.aborted) {
+          const ev = { type: 'streaming_complete', sessionId, claudeSessionId: ctrl.claudeSessionId || null, agentId, eventCount, timestamp: Date.now() };
+          recordTerminal(sessionId, ev);
+          broadcastSync(ev);
+        }
       } catch (e) {
-        broadcastSync({ type: 'streaming_error', sessionId, agentId, error: e.message || String(e), recoverable: false, timestamp: Date.now() });
+        if (!ctrl.aborted) {
+          const ev = { type: 'streaming_error', sessionId, claudeSessionId: ctrl.claudeSessionId || null, agentId, error: e.message || String(e), recoverable: false, timestamp: Date.now() };
+          recordTerminal(sessionId, ev);
+          broadcastSync(ev);
+        }
       } finally {
         activeChats.delete(sessionId);
+        broadcastSync({ type: 'chat_active_changed', reason: 'ended', sessionId, agentId, timestamp: Date.now() });
       }
     })();
 
@@ -142,7 +172,7 @@ export function register(router, deps) {
   router.handle('chat.active', () => {
     const sessions = [];
     for (const [sid, c] of activeChats) {
-      sessions.push({ sessionId: sid, agentId: c.agentId || null, model: c.model || null, cwd: c.cwd || null, startedAt: c.startedAt || null, pid: c.proc?.pid || null });
+      sessions.push({ sessionId: sid, claudeSessionId: c.claudeSessionId || null, agentId: c.agentId || null, model: c.model || null, cwd: c.cwd || null, startedAt: c.startedAt || null, pid: c.proc?.pid || null });
     }
     return { sessions };
   });
@@ -154,8 +184,16 @@ export function register(router, deps) {
     const ctrl = activeChats.get(sid);
     if (!ctrl) return { cancelled: false, reason: 'not-found' };
     ctrl.aborted = true;
+    // Broadcast the terminal 'cancelled' frame BEFORE killing the proc so a
+    // remote cancellation (other tab, dashboard stop-all) does not read as a
+    // normal completion (finding 44). streaming_cancelled is in BROADCAST_TYPES
+    // so every connected client sees it; it is also buffered for re-subscribers.
+    const ev = { type: 'streaming_cancelled', sessionId: sid, claudeSessionId: ctrl.claudeSessionId || null, agentId: ctrl.agentId || null, cancelled: true, timestamp: Date.now() };
+    recordTerminal(sid, ev);
+    broadcastSync(ev);
     try { ctrl.proc?.kill?.(); } catch {}
     activeChats.delete(sid);
+    broadcastSync({ type: 'chat_active_changed', reason: 'cancelled', sessionId: sid, agentId: ctrl.agentId || null, timestamp: Date.now() });
     return { cancelled: true };
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.958",
+  "version": "1.0.960",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/scripts/validate-mutations.mjs

@@ -0,0 +1,40 @@
+// Live security validation of the confined file-mutation endpoints.
+// Run with the server up: node scripts/validate-mutations.mjs
+const BASE = process.env.BASE || 'http://localhost:3000';
+const J = { 'Content-Type': 'application/json' };
+const results = [];
+async function post(route, body, headers = J) {
+  const r = await fetch(BASE + route, { method: 'POST', headers, body: typeof body === 'string' ? body : JSON.stringify(body) });
+  return { status: r.status, body: await r.text() };
+}
+async function check(name, expected, actual) {
+  const ok = actual.status === expected;
+  results.push({ name, expected, got: actual.status, ok, body: actual.body.slice(0, 80) });
+}
+const ROOT = 'C:\\dev\\agentgui';
+// security cases
+await check('rename-traversal', 403, await post('/api/rename', { path: ROOT + '\\..\\..\\Windows\\win.ini', newName: 'x.txt' }));
+await check('delete-out-of-roots', 403, await post('/api/delete', { path: 'C:\\Windows\\Temp\\x.txt' }));
+await check('delete-root-refused', 403, await post('/api/delete', { path: ROOT }));
+await check('mkdir-reserved-name', 400, await post('/api/mkdir', { dir: ROOT, name: 'CON' }));
+await check('mkdir-name-with-separator', 400, await post('/api/mkdir', { dir: ROOT, name: 'a/b' }));
+await check('mkdir-name-trailing-dot', 400, await post('/api/mkdir', { dir: ROOT, name: 'evil.' }));
+await check('mkdir-ads-colon', 400, await post('/api/mkdir', { dir: ROOT, name: 'a:b' }));
+await check('csrf-cross-site-form', 403, await post('/api/delete', 'path=x', { 'Content-Type': 'application/x-www-form-urlencoded', 'Sec-Fetch-Site': 'cross-site' }));
+// round trip
+await check('mkdir-ok', 200, await post('/api/mkdir', { dir: ROOT, name: '_wtest' }));
+const up = await fetch(BASE + '/api/upload-file?dir=' + encodeURIComponent(ROOT + '\\_wtest') + '&name=up.txt', { method: 'PUT', body: 'hello upload' });
+results.push({ name: 'upload-ok', expected: 200, got: up.status, ok: up.status === 200 });
+const up2 = await fetch(BASE + '/api/upload-file?dir=' + encodeURIComponent(ROOT + '\\_wtest') + '&name=up.txt', { method: 'PUT', body: 'x' });
+results.push({ name: 'upload-conflict-409', expected: 409, got: up2.status, ok: up2.status === 409 });
+await check('rename-ok', 200, await post('/api/rename', { path: ROOT + '\\_wtest\\up.txt', newName: 'up2.txt' }));
+await check('rename-conflict-409', 409, await post('/api/rename', { path: ROOT + '\\_wtest\\up2.txt', newName: 'up2.txt' }));
+await check('delete-nonempty-no-recursive-409', 409, await post('/api/delete', { path: ROOT + '\\_wtest' }));
+await check('delete-recursive-ok', 200, await post('/api/delete', { path: ROOT + '\\_wtest', recursive: true }));
+const st = await fetch(BASE + '/api/stat/' + encodeURIComponent(ROOT));
+results.push({ name: 'stat-ok', expected: 200, got: st.status, ok: st.status === 200 });
+const st2 = await fetch(BASE + '/api/stat/' + encodeURIComponent('C:\\Windows'));
+results.push({ name: 'stat-outside-403', expected: 403, got: st2.status, ok: st2.status === 403 });
+let fail = 0;
+for (const r of results) { if (!r.ok) fail++; console.log((r.ok ? 'PASS' : 'FAIL') + ' ' + r.name + ' expected=' + r.expected + ' got=' + r.got + (r.ok ? '' : ' body=' + (r.body || ''))); }
+process.exit(fail ? 1 : 0);

package/server.js

@@ -70,6 +70,33 @@ const staticDir = path.join(rootDir, 'site', 'app');
 if (!fs.existsSync(staticDir)) fs.mkdirSync(staticDir, { recursive: true });
 
 const expressApp = createExpressApp({ queries, BASE_URL });
+
+// ccsniff's /v1/history/sessions/:sid/events returns ALL events with no
+// paging. Shim (mounted BEFORE the ccsniff router; node_modules untouched):
+// when ?limit= is present, slice the most-recent window server-side and
+// report { total, offset } so the client can page older on demand via
+// ?before= (slice end index, exclusive; defaults to total).
+function historyEventsLimitShim(req, res, next) {
+  if (!/\/v1\/history\/sessions\/[^/]+\/events$/.test(req.path)) return next();
+  const limit = parseInt(req.query.limit, 10);
+  if (!Number.isFinite(limit) || limit <= 0) return next();
+  const origJson = res.json.bind(res);
+  res.json = (body) => {
+    try {
+      if (body && Array.isArray(body.events)) {
+        const total = body.events.length;
+        const before = parseInt(req.query.before, 10);
+        const end = (Number.isFinite(before) && before >= 0) ? Math.min(before, total) : total;
+        const start = Math.max(0, end - limit);
+        body = { ...body, events: body.events.slice(start, end), total, offset: start };
+      }
+    } catch {}
+    return origJson(body);
+  };
+  next();
+}
+expressApp.use(historyEventsLimitShim);
+
 try {
   const historyRouter = await createHistoryRouter({ projectsDir: process.env.CLAUDE_PROJECTS_DIR });
   expressApp.use('/', historyRouter);