aicodeman 1.34.0 → 1.35.0

package/dist/web/case-path.js

@@ -0,0 +1,182 @@
+/**
+ * @fileoverview Validation for "create a new case in a custom folder" (`POST /api/cases` with a
+ * `path`). Creating a case writes a scaffold (`CLAUDE.md`, `src/`, `.claude/settings.local.json`)
+ * and registers the folder in the shared, ownerless linked-cases registry, so the target has to be
+ * judged before anything is created:
+ *
+ *   - it must be an absolute path (a leading `~` is expanded) with no traversal and none of the shell
+ *     metacharacters a session's working directory is later rejected for (`isValidWorkingDir`), so
+ *     a case this accepts is one a session can actually start in;
+ *   - it must not be a system directory, the home directory itself, Codeman's own data directory, or
+ *     a credential/config tree (`~/.ssh`, `~/.aws`, `~/.claude`, ...). Judged on the path as typed AND on
+ *     its symlink-resolved form, against both the given and the symlink-resolved roots (a home reached
+ *     through a link, macOS's `/etc` -> `/private/etc`), so a link into a blocked tree is not a way
+ *     around it;
+ *   - it must not be, or be inside, a cases directory: a case there is a plain Create New, and the same
+ *     folder listed both as a local case and as a linked one would make deleting it remove files;
+ *   - its parent must already exist (one folder is created, never a whole chain), and the folder
+ *     itself must not exist or must be an EMPTY directory (a folder with contents is Link Existing's
+ *     job, and silently scaffolding into someone's project is the one thing this must never do);
+ *   - it must not be a symlink.
+ *
+ * Pure except for the filesystem reads in `prepareNewCasePath`; the policy lives in `blockedReason`
+ * so it can be tested without a disk.
+ *
+ * @module web/case-path
+ */
+import { promises as fs } from 'node:fs';
+import { basename, dirname, join, resolve, sep } from 'node:path';
+import { isValidWorkingDir } from './schemas.js';
+import { describeUnknownPath, probePath } from '../utils/index.js';
+/** System trees nobody creates a project in; creating one here is a mistake or an attack. */
+const BLOCKED_SYSTEM_ROOTS = [
+    '/bin',
+    '/boot',
+    '/dev',
+    '/etc',
+    '/lib',
+    '/lib32',
+    '/lib64',
+    '/proc',
+    '/run',
+    '/sbin',
+    '/sys',
+    '/usr',
+];
+/** Home-relative trees that hold credentials or other tools' own configuration. */
+const BLOCKED_HOME_DIRS = ['.ssh', '.gnupg', '.aws', '.kube', '.docker', '.claude', '.codex', '.gemini'];
+const isWithin = (child, root) => child === root || child.startsWith(root.endsWith(sep) ? root : root + sep);
+/** `~` and `~/x` to the home directory; anything else is returned unchanged. */
+export function expandHome(raw, home) {
+    if (raw === '~')
+        return home;
+    if (raw.startsWith('~/'))
+        return join(home, raw.slice(2));
+    return raw;
+}
+/**
+ * Why a case may not live at this (already absolute and normalised) path, or null. `systemRoots`
+ * defaults to the system trees as spelled; pass their symlink-resolved forms to judge a resolved path.
+ */
+export function blockedReason(absPath, ctx, systemRoots = BLOCKED_SYSTEM_ROOTS) {
+    if (absPath === sep)
+        return 'The filesystem root cannot be a case';
+    for (const root of systemRoots) {
+        if (isWithin(absPath, root))
+            return `${root} is a system directory`;
+    }
+    if (absPath === ctx.home)
+        return 'The home folder itself cannot be a case; pick a folder inside it';
+    for (const dir of BLOCKED_HOME_DIRS) {
+        if (isWithin(absPath, join(ctx.home, dir)))
+            return `~/${dir} holds credentials or another tool's configuration`;
+    }
+    if (isWithin(absPath, ctx.dataDir))
+        return "Codeman's own data folder cannot be a case";
+    // Any Codeman instance's data dir under the home folder (~/.codeman, ~/.codeman-beta, ...), not only
+    // the one this process uses.
+    if (absPath.startsWith(ctx.home + sep)) {
+        const firstSegment = absPath.slice(ctx.home.length + 1).split(sep)[0];
+        if (/^\.codeman/.test(firstSegment))
+            return "Codeman's own data folder cannot be a case";
+    }
+    for (const dir of ctx.casesDirs ?? []) {
+        if (isWithin(absPath, dir)) {
+            return 'That folder is inside the cases folder; create a case there with plain Create New (no custom folder)';
+        }
+    }
+    return null;
+}
+/** `p` with its symlinks resolved, or `p` itself when it does not exist (or cannot be read). */
+async function realpathOr(p) {
+    try {
+        return await fs.realpath(p);
+    }
+    catch {
+        return p;
+    }
+}
+/** The context and system roots with their symlinks resolved, for judging a resolved path. */
+async function resolvedPolicy(ctx) {
+    const [home, dataDir, casesDirs, systemRoots] = await Promise.all([
+        realpathOr(ctx.home),
+        realpathOr(ctx.dataDir),
+        Promise.all((ctx.casesDirs ?? []).map(realpathOr)),
+        Promise.all(BLOCKED_SYSTEM_ROOTS.map(realpathOr)),
+    ]);
+    return [{ home, dataDir, casesDirs }, systemRoots];
+}
+/**
+ * Judge `raw` as the folder for a new case and, if it is acceptable, say what to create.
+ * Never creates anything.
+ */
+export async function prepareNewCasePath(raw, ctx) {
+    const typed = raw.trim();
+    if (!typed)
+        return { ok: false, code: 'INVALID', reason: 'Enter a folder path' };
+    const expanded = expandHome(typed, ctx.home);
+    if (!isValidWorkingDir(expanded)) {
+        return {
+            ok: false,
+            code: 'INVALID',
+            reason: 'Use an absolute path with letters, numbers, spaces, - _ . only (no .., no shell characters)',
+        };
+    }
+    const target = resolve(expanded);
+    const typedBlock = blockedReason(target, ctx);
+    if (typedBlock)
+        return { ok: false, code: 'BLOCKED', reason: typedBlock };
+    // Bounded first: the parent can sit on a network mount that stopped answering, where the
+    // realpath/stat/lstat/readdir below would each hold a threadpool worker until it returns.
+    // It is one folder the user named, so the probe may pass the bulk cap (never the ceiling).
+    const parentState = await probePath(dirname(target), { pastCap: true });
+    if (parentState === 'absent') {
+        return { ok: false, code: 'NOT_FOUND', reason: `The parent folder ${dirname(target)} does not exist` };
+    }
+    if (parentState === 'unknown') {
+        return {
+            ok: false,
+            code: 'UNREACHABLE',
+            reason: describeUnknownPath('The parent folder', dirname(target), { pastCap: true }),
+        };
+    }
+    // Resolve the parent's symlinks, then judge again: a link into a blocked tree must not pass.
+    let realParent;
+    try {
+        realParent = await fs.realpath(dirname(target));
+        if (!(await fs.stat(realParent)).isDirectory()) {
+            return { ok: false, code: 'INVALID', reason: `${dirname(target)} is not a folder` };
+        }
+    }
+    catch {
+        return { ok: false, code: 'NOT_FOUND', reason: `The parent folder ${dirname(target)} does not exist` };
+    }
+    const real = join(realParent, basename(target));
+    // The resolved path against the roots as given AND as resolved: with home reached through a link, a
+    // link to <real home>/.ssh is only caught by the resolved home; on macOS /etc is /private/etc.
+    const [resolvedCtx, resolvedSystemRoots] = await resolvedPolicy(ctx);
+    const realBlock = blockedReason(real, ctx) ?? blockedReason(real, resolvedCtx, resolvedSystemRoots);
+    if (realBlock)
+        return { ok: false, code: 'BLOCKED', reason: realBlock };
+    try {
+        const st = await fs.lstat(real);
+        if (st.isSymbolicLink())
+            return { ok: false, code: 'INVALID', reason: `${target} is a symbolic link` };
+        if (!st.isDirectory())
+            return { ok: false, code: 'INVALID', reason: `${target} exists and is not a folder` };
+        if ((await fs.readdir(real)).length > 0) {
+            return {
+                ok: false,
+                code: 'EXISTS',
+                reason: `${target} already has files in it. Use "Link Existing" for a project that already exists`,
+            };
+        }
+        return { ok: true, path: real, existedEmpty: true };
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return { ok: true, path: real, existedEmpty: false };
+        return { ok: false, code: 'INVALID', reason: `Cannot read ${target}: ${err.message}` };
+    }
+}
+//# sourceMappingURL=case-path.js.map

package/dist/web/case-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"case-path.js","sourceRoot":"","sources":["../../src/web/case-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnE,6FAA6F;AAC7F,MAAM,oBAAoB,GAAG;IAC3B,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;CACP,CAAC;AAEF,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAiBzG,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,IAAY,EAAW,EAAE,CACxD,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAE7E,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAY;IAClD,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,GAAuB,EACvB,cAAiC,oBAAoB;IAErD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,sCAAsC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,GAAG,IAAI,wBAAwB,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,CAAC,IAAI;QAAE,OAAO,kEAAkE,CAAC;IACpG,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,GAAG,oDAAoD,CAAC;IAClH,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,4CAA4C,CAAC;IACxF,qGAAqG;IACrG,6BAA6B;IAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,4CAA4C,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,sGAAsG,CAAC;QAChH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,cAAc,CAAC,GAAuB;IACnD,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QACpB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,WAAW,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAuB;IAC3E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,6FAA6F;SACtG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE1E,yFAAyF;IACzF,0FAA0F;IAC1F,2FAA2F;IAC3F,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAqB,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,mBAAmB,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAqB,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;IACzG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,oGAAoG;IACpG,+FAA+F;IAC/F,MAAM,CAAC,WAAW,EAAE,mBAAmB,CAAC,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACpG,IAAI,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAExE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACvG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,6BAA6B,EAAE,CAAC;QAC7G,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG,MAAM,iFAAiF;aACnG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC3G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACpG,CAAC;AACH,CAAC"}