aicodeman 1.41.0 → 1.42.0

package/dist/web/routes/file-routes.js

@@ -12,8 +12,10 @@ import { createHash, randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { ApiErrorCode, createErrorResponse, getErrorMessage } from '../../types.js';
 import { compileFileQuery } from '../../utils/file-query.js';
+import { describeUnknownPath, probePathKind } from '../../utils/bounded-path-probe.js';
 import { fileStreamManager } from '../../file-stream-manager.js';
-import { AUDIO_ATTACHMENT_EXTENSIONS, AttachmentRegistrationError, attachmentRecordToEvent, attachmentRegistry, buildFileThumbnailRoute, isSupportedAttachmentExtension, registerExternalAttachment, TEXT_ATTACHMENT_EXTENSIONS, VIDEO_ATTACHMENT_EXTENSIONS, } from '../../attachment-registry.js';
+import { AUDIO_ATTACHMENT_EXTENSIONS, AttachmentRegistrationError, attachmentRecordToEvent, attachmentRegistry, buildFileThumbnailRoute, getAttachmentType, isSupportedAttachmentExtension, registerExternalAttachment, TEXT_ATTACHMENT_EXTENSIONS, VIDEO_ATTACHMENT_EXTENSIONS, } from '../../attachment-registry.js';
+import { FolderListingError, folderFilePath, folderGrants, folderAllowedForUser, listFolder, validFolderFileName, } from '../../folder-listing.js';
 import { generateFirstPageThumbnail } from '../../document-thumbnailer.js';
 import { getOfficePreviewPdfPath, getPreviewPdfDownloadName } from '../../document-preview-cache.js';
 import { sanitizeAttachmentHistoryItem } from '../../session-attachment-history.js';
@@ -125,8 +127,8 @@ function sendRawStream(reply, content, cleanup) {
     });
     content.pipe(reply.raw);
 }
-/** Byte source for a LOCAL file (the historical, only path). */
-function localFileSource(resolvedPath) {
+/** Byte source for a LOCAL file (the historical, only path). Shared with html-view-routes.ts. */
+export function localFileSource(resolvedPath) {
     return (range) => ({
         content: createReadStream(resolvedPath, range ? { start: range.start, end: range.end } : undefined),
     });
@@ -145,8 +147,11 @@ function localFileSource(resolvedPath) {
  * `open` supplies the bytes for the (optional) range, which is what lets a remote
  * case reuse this instead of re-implementing the 206/416 contract: same headers,
  * same status codes, whether the file sits on this host or behind an ssh pipe.
+ *
+ * Exported for the rendered-HTML route (html-view-routes.ts), so a page's own
+ * `<video>`/`<audio>` can seek as well.
  */
-function sendFileBody(reply, size, rangeHeader, open) {
+export function sendFileBody(reply, size, rangeHeader, open) {
     reply.header('Accept-Ranges', 'bytes');
     const range = parseByteRange(rangeHeader, size);
     if (range.kind === 'unsatisfiable') {
@@ -178,7 +183,9 @@ async function serveRawFile(reply, target, size, fileName, extension, download,
     // would be stored XSS. SVG was always here; HTML/HTM join it now that the text
     // family is servable, so widening what can be READ never widened what can RUN.
     // The preview overlay reads these through `fetch()`, which ignores the
-    // disposition, so a clicked .html still shows its source.
+    // disposition, so the source view of a clicked .html still works. Rendering it
+    // as a page is html-view-routes.ts's job (sandboxed, opaque origin), never this
+    // route's.
     const markupOnly = extension === 'svg' || extension === 'html' || extension === 'htm';
     if (download || markupOnly) {
         reply.header('Content-Type', markupOnly ? 'application/octet-stream' : MIME_TYPES[extension] || 'application/octet-stream');
@@ -296,6 +303,32 @@ async function resolveServableRemoteAttachment(reply, record, scope) {
     }
     return { path: probe.realPath, probe };
 }
+/**
+ * Stream a guard-checked file ({@link resolveServableAttachmentPath}) — the body of
+ * the attachment raw route, shared with the folder-grid file route.
+ *
+ * A remote file streams over ssh exactly like file-raw, with the same 200/206/416
+ * contract, and its size comes from the guard's own re-probe — so serving a remote
+ * file needs no stat the local branch would not also need.
+ */
+async function serveServableRaw(reply, servable, remote, fileName, extension, query) {
+    try {
+        const target = servable.probe && remote
+            ? { kind: 'remote', resolvedPath: servable.path, relativePath: '', remote, probe: servable.probe }
+            : { kind: 'local', resolvedPath: servable.path, relativePath: '' };
+        const size = servable.probe ? servable.probe.size : (await fs.stat(servable.path)).size;
+        if (exceedsXlsxPreviewLimit(extension, query, size)) {
+            sendXlsxPreviewTooLarge(reply, size);
+            return;
+        }
+        await serveRawFile(reply, target, size, fileName, extension, query.download === 'true', query.range);
+    }
+    catch (err) {
+        reply
+            .code(err instanceof RemoteFileAccessError ? 502 : 500)
+            .send(createErrorResponse(ApiErrorCode.OPERATION_FAILED, `Failed to read file: ${getErrorMessage(err)}`));
+    }
+}
 /**
  * Convert a DOCX/PPTX to a single-PDF preview (LibreOffice when available) and
  * stream it inline. PDF/PNG and text formats don't need conversion — callers
@@ -350,6 +383,14 @@ function getKnownSessionWorkingDir(ctx, sessionId, reply, req) {
     // wrapper exists for the callers that only need the workspace PATH.
     return getKnownSessionFileScope(ctx, sessionId, reply, req)?.workingDir;
 }
+/**
+ * A Docker case is a LOCAL session for the file routes (the workspace is a
+ * bind mount, so its paths are host paths), but `~` inside the container is the
+ * container's own seeded home, not this host's. Expanding `~/x.png` against the
+ * host's home would open a different file than the one the agent printed, so
+ * the form is refused instead of guessed.
+ */
+export const DOCKER_HOME_PATH_ERROR = 'A ~/ path inside a Docker case is the container home, which this server cannot read; use the absolute path';
 /**
  * The file-access scope of a session, live or persisted — the `workingDir`-only
  * variant of {@link getKnownSessionWorkingDir}, plus the remote metadata the routes
@@ -362,11 +403,11 @@ function getKnownSessionFileScope(ctx, sessionId, reply, req) {
     const user = getAuthUser(req);
     const liveSession = ctx.sessions.get(sessionId);
     if (liveSession && canAccessOwned(user, liveSession.owner)) {
-        return { workingDir: liveSession.workingDir, remote: liveSession.remote };
+        return { workingDir: liveSession.workingDir, remote: liveSession.remote, docker: !!liveSession.docker };
     }
     const stored = ctx.store.getSession(sessionId);
     if (stored && canAccessOwned(user, stored.owner)) {
-        return { workingDir: stored.workingDir, remote: stored.remote };
+        return { workingDir: stored.workingDir, remote: stored.remote, docker: !!stored.docker };
     }
     reply.code(404).send(createErrorResponse(ApiErrorCode.NOT_FOUND, `Session ${sessionId} not found`));
     return undefined;
@@ -1725,6 +1766,10 @@ export function registerFileRoutes(app, ctx) {
             reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Missing attachment path'));
             return;
         }
+        if (session.docker && body.path.startsWith('~/')) {
+            reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, DOCKER_HOME_PATH_ERROR));
+            return;
+        }
         try {
             // A remote case registers a path that lives on the REMOTE host: the guard and
             // the reachability check happen there (#415 — this is the path a clicked
@@ -1839,26 +1884,11 @@ export function registerFileRoutes(app, ctx) {
         });
         if (!servable)
             return;
-        try {
-            // A remote record streams over ssh exactly like file-raw, with the same
-            // 200/206/416 contract, and its size comes from the guard's own re-probe — so
-            // serving a remote attachment needs no stat the local branch would not also need.
-            const remote = session.remote;
-            const target = servable.probe && remote
-                ? { kind: 'remote', resolvedPath: servable.path, relativePath: '', remote, probe: servable.probe }
-                : { kind: 'local', resolvedPath: servable.path, relativePath: '' };
-            const size = servable.probe ? servable.probe.size : (await fs.stat(servable.path)).size;
-            if (exceedsXlsxPreviewLimit(record.extension, { preview, download }, size)) {
-                sendXlsxPreviewTooLarge(reply, size);
-                return;
-            }
-            await serveRawFile(reply, target, size, record.fileName, record.extension, download === 'true', req.headers.range);
-        }
-        catch (err) {
-            reply
-                .code(err instanceof RemoteFileAccessError ? 502 : 500)
-                .send(createErrorResponse(ApiErrorCode.OPERATION_FAILED, `Failed to read file: ${getErrorMessage(err)}`));
-        }
+        await serveServableRaw(reply, servable, session.remote, record.fileName, record.extension, {
+            download,
+            preview,
+            range: req.headers.range,
+        });
     });
     // Serve a converted PDF preview of a registered attachment by id. Office docs
     // convert server-side; PDF/PNG/text redirect to the raw route.
@@ -1910,6 +1940,163 @@ export function registerFileRoutes(app, ctx) {
         }
         await serveThumbnail(reply, servable.path, record.extension);
     });
+    // ===== Folder grid =====
+    // Grant + list a folder (absolute or `~/` on the session's host) for the preview
+    // grid. Same guard as a single external attachment; the grid then fetches files by
+    // `folderId + name`, so no browser request carries a path. See folder-listing.ts.
+    app.post('/api/sessions/:id/folders', async (req, reply) => {
+        const { id } = req.params;
+        const scope = getKnownSessionFileScope(ctx, id, reply, req);
+        if (!scope)
+            return;
+        const body = (req.body || {});
+        if (!body.path || typeof body.path !== 'string') {
+            reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Missing folder path'));
+            return;
+        }
+        // A bare `~` expands to this host's home too, not the container's.
+        if (scope.docker && (body.path === '~' || body.path.startsWith('~/'))) {
+            reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, DOCKER_HOME_PATH_ERROR));
+            return;
+        }
+        try {
+            const listing = await listFolder(id, body.path, {
+                sessionWorkingDir: scope.workingDir,
+                remote: scope.remote,
+                user: getAuthUser(req),
+            });
+            return { success: true, data: listing };
+        }
+        catch (err) {
+            if (err instanceof FolderListingError) {
+                const code = err.statusCode === 404
+                    ? ApiErrorCode.NOT_FOUND
+                    : err.statusCode >= 500
+                        ? ApiErrorCode.OPERATION_FAILED
+                        : ApiErrorCode.INVALID_INPUT;
+                reply.code(err.statusCode).send(createErrorResponse(code, err.message));
+                return;
+            }
+            return reply
+                .code(500)
+                .send(createErrorResponse(ApiErrorCode.OPERATION_FAILED, `Failed to list folder: ${getErrorMessage(err)}`));
+        }
+    });
+    /**
+     * One file of a granted folder, guard-checked like an attachment: the name is a
+     * bare file name of a supported type, and the joined path goes through the same
+     * {@link resolveServableAttachmentPath} (blocklist, workspace confinement, symlink
+     * re-resolution, remote re-probe) an attachment by id does. The multi-user rule
+     * ({@link folderAllowedForUser}) runs again on the resolved file: a symlink inside
+     * the granted folder must not lead into another user's space.
+     */
+    async function resolveFolderFile(req, reply) {
+        const { id, folderId, name } = req.params;
+        const scope = getKnownSessionFileScope(ctx, id, reply, req);
+        if (!scope)
+            return null;
+        const grant = folderGrants.get(id, folderId);
+        if (!grant) {
+            reply.code(404).send(createErrorResponse(ApiErrorCode.NOT_FOUND, 'Folder not found'));
+            return null;
+        }
+        const fileName = validFolderFileName(name);
+        if (!fileName) {
+            reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid file name'));
+            return null;
+        }
+        const filePath = folderFilePath(grant.dir, fileName);
+        if (!scope.remote) {
+            // Bounded, like the folder itself: the grant may point at a mount that has stopped answering since.
+            const kind = await probePathKind(filePath, { pastCap: true });
+            if (kind === 'unknown') {
+                reply
+                    .code(503)
+                    .send(createErrorResponse(ApiErrorCode.OPERATION_FAILED, describeUnknownPath('File', filePath, { pastCap: true })));
+                return null;
+            }
+            if (kind !== 'file') {
+                reply.code(404).send(createErrorResponse(ApiErrorCode.NOT_FOUND, 'File not found'));
+                return null;
+            }
+        }
+        const extension = extname(fileName).toLowerCase().replace(/^\./, '');
+        const record = {
+            attachmentId: '',
+            sessionId: id,
+            filePath,
+            fileName,
+            extension,
+            attachmentType: getAttachmentType(extension),
+            size: 0,
+            mtimeMs: 0,
+            timestamp: 0,
+            source: 'external',
+        };
+        const servable = await resolveServableAttachmentPath(reply, record, scope);
+        if (!servable)
+            return null;
+        // The requested NAME only opens the door; registration judges the file a
+        // symlink resolves to (supported extension, regular file) and so does this.
+        // Without it `shot.png -> ../secret.bin` is served, and a FIFO or a device
+        // behind a supported name parks a worker on an open that never returns.
+        if (!isSupportedAttachmentExtension(extname(servable.path))) {
+            reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Unsupported attachment type'));
+            return null;
+        }
+        const isRegularFile = scope.remote
+            ? servable.probe?.kind === 'file'
+            : await fs.stat(servable.path).then((stat) => stat.isFile(), () => false);
+        if (!isRegularFile) {
+            reply.code(400).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Attachment path is not a file'));
+            return null;
+        }
+        if (!folderAllowedForUser(servable.path, getAuthUser(req), scope)) {
+            reply.code(403).send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'File is outside your space'));
+            return null;
+        }
+        return { scope, servable, name: fileName, extension };
+    }
+    app.get('/api/sessions/:id/folders/:folderId/files/:name/raw', async (req, reply) => {
+        const file = await resolveFolderFile(req, reply);
+        if (!file)
+            return;
+        const { download, preview } = req.query;
+        await serveServableRaw(reply, file.servable, file.scope.remote, file.name, file.extension, {
+            download,
+            preview,
+            range: req.headers.range,
+        });
+    });
+    app.get('/api/sessions/:id/folders/:folderId/files/:name/preview', async (req, reply) => {
+        const file = await resolveFolderFile(req, reply);
+        if (!file)
+            return;
+        if (file.extension !== 'docx' && file.extension !== 'pptx') {
+            const { id, folderId } = req.params;
+            reply.redirect(`/api/sessions/${encodeURIComponent(id)}/folders/${encodeURIComponent(folderId)}/files/${encodeURIComponent(file.name)}/raw`);
+            return;
+        }
+        if (file.servable.probe) {
+            reply
+                .code(400)
+                .send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Office document preview is not available for files in a remote (SSH) case'));
+            return;
+        }
+        await serveConvertedPreview(reply, file.servable.path, file.name, file.extension);
+    });
+    app.get('/api/sessions/:id/folders/:folderId/files/:name/thumbnail', async (req, reply) => {
+        const file = await resolveFolderFile(req, reply);
+        if (!file)
+            return;
+        if (file.servable.probe) {
+            reply
+                .code(400)
+                .send(createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Thumbnails are not available for files in a remote (SSH) case'));
+            return;
+        }
+        await serveThumbnail(reply, file.servable.path, file.extension);
+    });
     // Serve converted document previews for a workspace-relative path. DOCX/PPTX
     // are converted to PDF via LibreOffice; PDF/PNG/text preview through file-raw.
     app.get('/api/sessions/:id/file-preview', async (req, reply) => {