claude-code-workflow 6.3.18 → 6.3.20

package/ccw/src/core/routes/discovery-routes.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck
 /**
  * Discovery Routes Module
  *
@@ -24,19 +23,9 @@
  * - PATCH  /api/discoveries/:id/findings/:fid - Update finding status
  * - DELETE /api/discoveries/:id          - Delete discovery session
  */
-import type { IncomingMessage, ServerResponse } from 'http';
 import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync, rmSync } from 'fs';
 import { join } from 'path';
-
-export interface RouteContext {
-  pathname: string;
-  url: URL;
-  req: IncomingMessage;
-  res: ServerResponse;
-  initialPath: string;
-  handlePostRequest: (req: IncomingMessage, res: ServerResponse, handler: (body: unknown) => Promise<any>) => void;
-  broadcastToClients: (data: unknown) => void;
-}
+import type { RouteContext } from './types.js';
 
 // ========== Helper Functions ==========
 

package/ccw/src/core/routes/files-routes.ts

@@ -1,21 +1,11 @@
-// @ts-nocheck
 /**
  * Files Routes Module
  * Handles all file browsing related API endpoints
  */
-import type { IncomingMessage, ServerResponse } from 'http';
 import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
-
-export interface RouteContext {
-  pathname: string;
-  url: URL;
-  req: IncomingMessage;
-  res: ServerResponse;
-  initialPath: string;
-  handlePostRequest: (req: IncomingMessage, res: ServerResponse, handler: (body: unknown) => Promise<any>) => void;
-  broadcastToClients: (data: unknown) => void;
-}
+import { validatePath as validateAllowedPath } from '../../utils/path-validator.js';
+import type { RouteContext } from './types.js';
 
 // ========================================
 // Constants
@@ -78,6 +68,39 @@ const EXT_TO_LANGUAGE = {
   '.svelte': 'html'
 };
 
+interface ExplorerFileEntry {
+  name: string;
+  type: 'directory' | 'file';
+  path: string;
+  hasClaudeMd?: boolean;
+}
+
+interface ExplorerDirectoryFilesResult {
+  path?: string;
+  files: ExplorerFileEntry[];
+  gitignorePatterns?: string[];
+  error?: string;
+}
+
+interface ExplorerFileContentResult {
+  error?: string;
+  content?: string;
+  language?: string;
+  isMarkdown?: boolean;
+  fileName?: string;
+  path?: string;
+  size?: number;
+  lines?: number;
+}
+
+interface UpdateClaudeMdResult {
+  success?: boolean;
+  error?: string;
+  message?: string;
+  output?: string;
+  path?: string;
+}
+
 // ========================================
 // Helper Functions
 // ========================================
@@ -87,7 +110,7 @@ const EXT_TO_LANGUAGE = {
  * @param {string} gitignorePath - Path to .gitignore file
  * @returns {string[]} Array of gitignore patterns
  */
-function parseGitignore(gitignorePath) {
+function parseGitignore(gitignorePath: string): string[] {
   try {
     if (!existsSync(gitignorePath)) return [];
     const content = readFileSync(gitignorePath, 'utf8');
@@ -108,7 +131,7 @@ function parseGitignore(gitignorePath) {
  * @param {boolean} isDirectory - Whether the entry is a directory
  * @returns {boolean}
  */
-function shouldIgnore(name, patterns, isDirectory) {
+function shouldIgnore(name: string, patterns: string[], isDirectory: boolean): boolean {
   // Always exclude certain directories
   if (isDirectory && EXPLORER_EXCLUDE_DIRS.includes(name)) {
     return true;
@@ -155,7 +178,7 @@ function shouldIgnore(name, patterns, isDirectory) {
  * @param {string} dirPath - Directory path to list
  * @returns {Promise<Object>}
  */
-async function listDirectoryFiles(dirPath) {
+async function listDirectoryFiles(dirPath: string): Promise<ExplorerDirectoryFilesResult> {
   try {
     // Normalize path
     let normalizedPath = dirPath.replace(/\\/g, '/');
@@ -178,7 +201,7 @@ async function listDirectoryFiles(dirPath) {
     // Read directory entries
     const entries = readdirSync(normalizedPath, { withFileTypes: true });
 
-    const files = [];
+    const files: ExplorerFileEntry[] = [];
     for (const entry of entries) {
       const isDirectory = entry.isDirectory();
 
@@ -188,7 +211,7 @@ async function listDirectoryFiles(dirPath) {
       }
 
       const entryPath = join(normalizedPath, entry.name);
-      const fileInfo = {
+      const fileInfo: ExplorerFileEntry = {
         name: entry.name,
         type: isDirectory ? 'directory' : 'file',
         path: entryPath.replace(/\\/g, '/')
@@ -226,7 +249,7 @@ async function listDirectoryFiles(dirPath) {
  * @param {string} filePath - Path to file
  * @returns {Promise<Object>}
  */
-async function getFileContent(filePath) {
+async function getFileContent(filePath: string): Promise<ExplorerFileContentResult> {
   try {
     // Normalize path
     let normalizedPath = filePath.replace(/\\/g, '/');
@@ -251,9 +274,11 @@ async function getFileContent(filePath) {
     // Read file content
     const content = readFileSync(normalizedPath, 'utf8');
     const ext = normalizedPath.substring(normalizedPath.lastIndexOf('.')).toLowerCase();
-    const language = EXT_TO_LANGUAGE[ext] || 'plaintext';
+    const language = Object.prototype.hasOwnProperty.call(EXT_TO_LANGUAGE, ext)
+      ? EXT_TO_LANGUAGE[ext as keyof typeof EXT_TO_LANGUAGE]
+      : 'plaintext';
     const isMarkdown = ext === '.md' || ext === '.markdown';
-    const fileName = normalizedPath.split('/').pop();
+    const fileName = normalizedPath.split('/').pop() ?? normalizedPath;
 
     return {
       content,
@@ -277,7 +302,7 @@ async function getFileContent(filePath) {
  * @param {string} strategy - Update strategy (single-layer, multi-layer)
  * @returns {Promise<Object>}
  */
-async function triggerUpdateClaudeMd(targetPath, tool, strategy) {
+async function triggerUpdateClaudeMd(targetPath: string, tool: string, strategy: string): Promise<UpdateClaudeMdResult> {
   const { spawn } = await import('child_process');
 
   // Normalize path
@@ -303,7 +328,7 @@ async function triggerUpdateClaudeMd(targetPath, tool, strategy) {
 
   console.log(`[Explorer] Running async: ccw tool exec update_module_claude with ${tool} (${strategy})`);
 
-  return new Promise((resolve) => {
+  return new Promise<UpdateClaudeMdResult>((resolve) => {
     const isWindows = process.platform === 'win32';
 
     // Spawn the process
@@ -316,34 +341,39 @@ async function triggerUpdateClaudeMd(targetPath, tool, strategy) {
     let stdout = '';
     let stderr = '';
 
-    child.stdout.on('data', (data) => {
+    child.stdout.on('data', (data: Buffer) => {
       stdout += data.toString();
     });
 
-    child.stderr.on('data', (data) => {
+    child.stderr.on('data', (data: Buffer) => {
       stderr += data.toString();
     });
 
-    child.on('close', (code) => {
+    child.on('close', (code: number | null) => {
       if (code === 0) {
         // Parse the JSON output from the tool
-        let result;
+        let result: unknown;
         try {
           result = JSON.parse(stdout);
         } catch {
           result = { output: stdout };
         }
 
-        if (result.success === false || result.error) {
+        const parsed = typeof result === 'object' && result !== null ? (result as Record<string, unknown>) : null;
+        const parsedSuccess = typeof parsed?.success === 'boolean' ? parsed.success : undefined;
+        const parsedError = typeof parsed?.error === 'string' ? parsed.error : undefined;
+        const parsedMessage = typeof parsed?.message === 'string' ? parsed.message : undefined;
+
+        if (parsedSuccess === false || parsedError) {
           resolve({
             success: false,
-            error: result.error || result.message || 'Update failed',
+            error: parsedError || parsedMessage || 'Update failed',
             output: stdout
           });
         } else {
           resolve({
             success: true,
-            message: result.message || `CLAUDE.md updated successfully using ${tool} (${strategy})`,
+            message: parsedMessage || `CLAUDE.md updated successfully using ${tool} (${strategy})`,
             output: stdout,
             path: normalizedPath
           });
@@ -357,11 +387,11 @@ async function triggerUpdateClaudeMd(targetPath, tool, strategy) {
       }
     });
 
-    child.on('error', (error) => {
+    child.on('error', (error: unknown) => {
       console.error('Error spawning process:', error);
       resolve({
         success: false,
-        error: (error as Error).message,
+        error: error instanceof Error ? error.message : String(error),
         output: ''
       });
     });
@@ -392,9 +422,19 @@ export async function handleFilesRoutes(ctx: RouteContext): Promise<boolean> {
   // API: List directory files with .gitignore filtering (Explorer view)
   if (pathname === '/api/files') {
     const dirPath = url.searchParams.get('path') || initialPath;
-    const filesData = await listDirectoryFiles(dirPath);
-    res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(filesData));
+
+    try {
+      const validatedDir = await validateAllowedPath(dirPath, { mustExist: true, allowedDirectories: [initialPath] });
+      const filesData = await listDirectoryFiles(validatedDir);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(filesData));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const status = message.includes('Access denied') ? 403 : 400;
+      console.error(`[Files] Path validation failed: ${message}`);
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: status === 403 ? 'Access denied' : 'Invalid path', files: [] }));
+    }
     return true;
   }
 
@@ -406,20 +446,52 @@ export async function handleFilesRoutes(ctx: RouteContext): Promise<boolean> {
       res.end(JSON.stringify({ error: 'File path is required' }));
       return true;
     }
-    const fileData = await getFileContent(filePath);
-    res.writeHead(fileData.error ? 404 : 200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(fileData));
+
+    try {
+      const validatedFile = await validateAllowedPath(filePath, { mustExist: true, allowedDirectories: [initialPath] });
+      const fileData = await getFileContent(validatedFile);
+      res.writeHead(fileData.error ? 404 : 200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(fileData));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const status = message.includes('Access denied') ? 403 : 400;
+      console.error(`[Files] Path validation failed: ${message}`);
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: status === 403 ? 'Access denied' : 'Invalid path' }));
+    }
     return true;
   }
 
   // API: Update CLAUDE.md using CLI tools (Explorer view)
   if (pathname === '/api/update-claude-md' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { path: targetPath, tool = 'gemini', strategy = 'single-layer' } = body;
-      if (!targetPath) {
+      if (typeof body !== 'object' || body === null) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const {
+        path: targetPath,
+        tool = 'gemini',
+        strategy = 'single-layer'
+      } = body as { path?: unknown; tool?: unknown; strategy?: unknown };
+
+      if (typeof targetPath !== 'string' || targetPath.trim().length === 0) {
         return { error: 'path is required', status: 400 };
       }
-      return await triggerUpdateClaudeMd(targetPath, tool, strategy);
+
+      try {
+        const validatedPath = await validateAllowedPath(targetPath, { mustExist: true, allowedDirectories: [initialPath] });
+        return await triggerUpdateClaudeMd(
+          validatedPath,
+          typeof tool === 'string' ? tool : 'gemini',
+          typeof strategy === 'string' ? strategy : 'single-layer'
+        );
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = message.includes('Access denied') ? 403 : 400;
+        console.error(`[Files] Path validation failed: ${message}`);
+        return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+      }
     });
     return true;
   }

package/ccw/src/core/routes/graph-routes.ts

@@ -2,21 +2,12 @@
  * Graph Routes Module
  * Handles graph visualization API endpoints for codex-lens data
  */
-import type { IncomingMessage, ServerResponse } from 'http';
 import { homedir } from 'os';
 import { join, resolve, normalize } from 'path';
 import { existsSync, readdirSync } from 'fs';
 import Database from 'better-sqlite3';
-
-export interface RouteContext {
-  pathname: string;
-  url: URL;
-  req: IncomingMessage;
-  res: ServerResponse;
-  initialPath: string;
-  handlePostRequest: (req: IncomingMessage, res: ServerResponse, handler: (body: unknown) => Promise<any>) => void;
-  broadcastToClients: (data: unknown) => void;
-}
+import { validatePath as validateAllowedPath } from '../../utils/path-validator.js';
+import type { RouteContext } from './types.js';
 
 /**
  * PathMapper utility class (simplified from codex-lens Python implementation)
@@ -82,28 +73,22 @@ interface ImpactAnalysis {
  * Validate and sanitize project path to prevent path traversal attacks
  * @returns sanitized absolute path or null if invalid
  */
-function validateProjectPath(projectPath: string, initialPath: string): string | null {
-  if (!projectPath) {
-    return initialPath;
-  }
+type ProjectPathValidationResult =
+  | { path: string; status: 200 }
+  | { path: null; status: number; error: string };
 
-  // Resolve to absolute path
-  const resolved = resolve(projectPath);
-  const normalized = normalize(resolved);
-
-  // Check for path traversal attempts
-  if (normalized.includes('..') || normalized !== resolved) {
-    console.error(`[Graph] Path traversal attempt blocked: ${projectPath}`);
-    return null;
-  }
+async function validateProjectPath(projectPath: string, initialPath: string): Promise<ProjectPathValidationResult> {
+  const candidate = projectPath || initialPath;
 
-  // Ensure path exists and is a directory
-  if (!existsSync(normalized)) {
-    console.error(`[Graph] Path does not exist: ${normalized}`);
-    return null;
+  try {
+    const validated = await validateAllowedPath(candidate, { mustExist: true, allowedDirectories: [initialPath] });
+    return { path: validated, status: 200 };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const status = message.includes('Access denied') ? 403 : 400;
+    console.error(`[Graph] Project path validation failed: ${message}`);
+    return { path: null, status, error: status === 403 ? 'Access denied' : 'Invalid project path' };
   }
-
-  return normalized;
 }
 
 /**
@@ -440,18 +425,20 @@ export async function handleGraphRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Graph Nodes - Get all symbols as graph nodes
   if (pathname === '/api/graph/nodes') {
     const rawPath = url.searchParams.get('path') || initialPath;
-    const projectPath = validateProjectPath(rawPath, initialPath);
+    const projectPathResult = await validateProjectPath(rawPath, initialPath);
     const limitStr = url.searchParams.get('limit') || '1000';
     const limit = Math.min(parseInt(limitStr, 10) || 1000, 5000); // Max 5000 nodes
     const fileFilter = url.searchParams.get('file') || undefined;
     const moduleFilter = url.searchParams.get('module') || undefined;
 
-    if (!projectPath) {
-      res.writeHead(400, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Invalid project path', nodes: [] }));
+    if (projectPathResult.path === null) {
+      res.writeHead(projectPathResult.status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: projectPathResult.error, nodes: [] }));
       return true;
     }
 
+    const projectPath = projectPathResult.path;
+
     try {
       const allNodes = await querySymbols(projectPath, fileFilter, moduleFilter);
       const nodes = allNodes.slice(0, limit);
@@ -474,18 +461,20 @@ export async function handleGraphRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Graph Edges - Get all relationships as graph edges
   if (pathname === '/api/graph/edges') {
     const rawPath = url.searchParams.get('path') || initialPath;
-    const projectPath = validateProjectPath(rawPath, initialPath);
+    const projectPathResult = await validateProjectPath(rawPath, initialPath);
     const limitStr = url.searchParams.get('limit') || '2000';
     const limit = Math.min(parseInt(limitStr, 10) || 2000, 10000); // Max 10000 edges
     const fileFilter = url.searchParams.get('file') || undefined;
     const moduleFilter = url.searchParams.get('module') || undefined;
 
-    if (!projectPath) {
-      res.writeHead(400, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Invalid project path', edges: [] }));
+    if (projectPathResult.path === null) {
+      res.writeHead(projectPathResult.status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: projectPathResult.error, edges: [] }));
       return true;
     }
 
+    const projectPath = projectPathResult.path;
+
     try {
       const allEdges = await queryRelationships(projectPath, fileFilter, moduleFilter);
       const edges = allEdges.slice(0, limit);
@@ -508,14 +497,16 @@ export async function handleGraphRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Get available files and modules for filtering
   if (pathname === '/api/graph/files') {
     const rawPath = url.searchParams.get('path') || initialPath;
-    const projectPath = validateProjectPath(rawPath, initialPath);
+    const projectPathResult = await validateProjectPath(rawPath, initialPath);
 
-    if (!projectPath) {
-      res.writeHead(400, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Invalid project path', files: [], modules: [] }));
+    if (projectPathResult.path === null) {
+      res.writeHead(projectPathResult.status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: projectPathResult.error, files: [], modules: [] }));
       return true;
     }
 
+    const projectPath = projectPathResult.path;
+
     try {
       const mapper = new PathMapper();
       const rootDbPath = mapper.sourceToIndexDb(projectPath);
@@ -570,15 +561,17 @@ export async function handleGraphRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Impact Analysis - Get impact analysis for a symbol
   if (pathname === '/api/graph/impact') {
     const rawPath = url.searchParams.get('path') || initialPath;
-    const projectPath = validateProjectPath(rawPath, initialPath);
+    const projectPathResult = await validateProjectPath(rawPath, initialPath);
     const symbolId = url.searchParams.get('symbol');
 
-    if (!projectPath) {
-      res.writeHead(400, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'Invalid project path', directDependents: [], affectedFiles: [] }));
+    if (projectPathResult.path === null) {
+      res.writeHead(projectPathResult.status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: projectPathResult.error, directDependents: [], affectedFiles: [] }));
       return true;
     }
 
+    const projectPath = projectPathResult.path;
+
     if (!symbolId) {
       res.writeHead(400, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'symbol parameter is required', directDependents: [], affectedFiles: [] }));

package/ccw/src/core/routes/help-routes.ts

@@ -1,22 +1,11 @@
-// @ts-nocheck
 /**
  * Help Routes Module
  * Handles all Help-related API endpoints for command guide and CodexLens docs
  */
-import type { IncomingMessage, ServerResponse } from 'http';
 import { readFileSync, existsSync, watch } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
-
-export interface RouteContext {
-  pathname: string;
-  url: URL;
-  req: IncomingMessage;
-  res: ServerResponse;
-  initialPath: string;
-  handlePostRequest: (req: IncomingMessage, res: ServerResponse, handler: (body: unknown) => Promise<any>) => void;
-  broadcastToClients: (data: unknown) => void;
-}
+import type { RouteContext } from './types.js';
 
 // ========== In-Memory Cache ==========
 interface CacheEntry {
@@ -101,6 +90,7 @@ function initializeFileWatchers(): void {
     });
 
     watchersInitialized = true;
+    (watcher as any).unref?.();
     console.log(`File watchers initialized for: ${indexDir}`);
   } catch (error) {
     console.error('Failed to initialize file watchers:', error);