codebay 0.14.0 → 0.16.0

package/src/lib/sandbox-ops.server.ts

@@ -0,0 +1,263 @@
+import {
+	EXEC_STDIN_MAX_BYTES_BASE64,
+	afterMarker,
+	execInContainer,
+	execTargetFor,
+	markerLine
+} from './exec.server.ts';
+import { SOURCE_INJECTED_ENV } from './devcontainer.server.ts';
+import { getOption, type InstanceRow } from './db.server.ts';
+import { HOME_PRELUDE, shellSingleQuote as quote } from './container-files.server.ts';
+
+/** Enough for a big diff or a test run's output, small enough not to blow a caller's context. */
+export const OUTPUT_CAP = 200_000;
+
+/** What `write_file` can carry in one call: the content rides base64'd through the exec env carrier. */
+export const WRITE_FILE_MAX_BYTES = EXEC_STDIN_MAX_BYTES_BASE64;
+
+const CODE_MARKER = '__CODEBAY_CMD__';
+const OUT_MARKER = '__CODEBAY_CMD_OUT__';
+const ERR_MARKER = '__CODEBAY_CMD_ERR__';
+const END_MARKER = '__CODEBAY_CMD_END__';
+
+/** `timeout`'s own exit code for a command it had to kill. */
+const TIMEOUT_EXIT = 124;
+
+export interface CommandResult {
+	exitCode: number;
+	stdout: string;
+	stderr: string;
+	timedOut: boolean;
+	truncated: boolean;
+}
+
+/** Everything here runs from the workspace, since an exec only inherits the image's WorkingDir. */
+function workspacePrelude(row: InstanceRow): string {
+	const cd = row.remote_workspace_folder
+		? `cd ${quote(row.remote_workspace_folder)} || exit 1; `
+		: '';
+	return `${HOME_PRELUDE}[ -n "$HOME" ] || export HOME="$h"; ${cd}`;
+}
+
+function decodeBlock(stdout: string, marker: string): string {
+	const rest = afterMarker(stdout, marker);
+	if (rest === null) return '';
+	const end = rest.indexOf(END_MARKER);
+	// GNU base64 wraps at 76 columns, and a trimmed capture can drop the final newline.
+	const b64 = (end === -1 ? rest : rest.slice(0, end)).replace(/\s+/g, '');
+	return b64 ? Buffer.from(b64, 'base64').toString('utf8') : '';
+}
+
+function cap(text: string): { text: string; truncated: boolean } {
+	return text.length > OUTPUT_CAP
+		? { text: text.slice(0, OUTPUT_CAP) + '\n… output truncated', truncated: true }
+		: { text, truncated: false };
+}
+
+/**
+ * The command rides in through the stdin carrier rather than the script body, so nothing has to be
+ * escaped and it never reaches the container's process list; output is base64'd because the
+ * capture path trims and the demuxed stream is text.
+ */
+export async function execCommand(
+	row: InstanceRow,
+	command: string,
+	opts: { timeoutSeconds?: number; cwd?: string } = {}
+): Promise<CommandResult> {
+	const seconds = Math.max(1, Math.min(opts.timeoutSeconds ?? 120, 3600));
+	const script =
+		workspacePrelude(row) +
+		SOURCE_INJECTED_ENV +
+		`o=$(mktemp); e=$(mktemp); ` +
+		// The in-container `timeout` is what actually kills the process; execInContainer's own
+		// timeoutMs below is only a backstop for a wedged docker stream.
+		`if command -v timeout >/dev/null 2>&1; then timeout -k 5 ${seconds} bash -c "$CODEBAY_STDIN" >"$o" 2>"$e"; ` +
+		`else bash -c "$CODEBAY_STDIN" >"$o" 2>"$e"; fi; c=$?; ` +
+		`printf '${CODE_MARKER}%s\\n' "$c"; ` +
+		`printf '${OUT_MARKER}\\n'; base64 < "$o"; printf '\\n${END_MARKER}\\n'; ` +
+		`printf '${ERR_MARKER}\\n'; base64 < "$e"; printf '\\n${END_MARKER}\\n'; ` +
+		`rm -f "$o" "$e"; true`;
+
+	const res = await execInContainer(execTargetFor(row), {
+		script,
+		stdin: opts.cwd ? `cd ${quote(opts.cwd)} || exit 1\n${command}` : command,
+		capture: true,
+		timeoutMs: (seconds + 15) * 1000
+	});
+	if (!res.ok) {
+		return {
+			exitCode: -1,
+			stdout: '',
+			stderr: res.error ?? 'the command could not be run',
+			timedOut: false,
+			truncated: false
+		};
+	}
+
+	const exitCode = Number.parseInt(markerLine(res.stdout, CODE_MARKER) ?? '', 10);
+	const out = cap(decodeBlock(res.stdout, OUT_MARKER));
+	const err = cap(decodeBlock(res.stdout, ERR_MARKER));
+	return {
+		exitCode: Number.isFinite(exitCode) ? exitCode : -1,
+		stdout: out.text,
+		stderr: err.text,
+		timedOut: exitCode === TIMEOUT_EXIT,
+		truncated: out.truncated || err.truncated
+	};
+}
+
+/** Throws the command's own stderr, so a tool caller sees why git or gh refused. */
+async function must(row: InstanceRow, command: string, timeoutSeconds = 120): Promise<string> {
+	const res = await execCommand(row, command, { timeoutSeconds });
+	if (res.exitCode !== 0) {
+		throw new Error((res.stderr || res.stdout || `command failed (exit ${res.exitCode})`).trim());
+	}
+	return res.stdout;
+}
+
+/**
+ * The path arrives as an argv entry rather than spliced into the script, so no amount of quoting
+ * in a caller-supplied filename can escape into the shell.
+ */
+export async function readWorkspaceFile(row: InstanceRow, path: string): Promise<string> {
+	const script =
+		workspacePrelude(row) +
+		`if [ ! -f "$1" ]; then printf '${CODE_MARKER}1\\n'; exit 0; fi; ` +
+		`printf '${CODE_MARKER}0\\n'; printf '${OUT_MARKER}\\n'; base64 < "$1"; printf '\\n${END_MARKER}\\n'`;
+	const res = await execInContainer(execTargetFor(row), {
+		script,
+		args: ['read-file', path],
+		capture: true,
+		timeoutMs: 30_000
+	});
+	if (!res.ok) throw new Error(res.error ?? 'could not read the file');
+	if (res.stdout.includes(`${CODE_MARKER}1`)) throw new Error(`no such file: ${path}`);
+	return cap(decodeBlock(res.stdout, OUT_MARKER)).text;
+}
+
+export async function writeWorkspaceFile(
+	row: InstanceRow,
+	path: string,
+	content: string
+): Promise<void> {
+	const bytes = Buffer.byteLength(content, 'utf8');
+	if (bytes > WRITE_FILE_MAX_BYTES) {
+		throw new Error(
+			`content is ${bytes} bytes; write_file carries at most ${WRITE_FILE_MAX_BYTES} — split it, or ` +
+				'build the file inside the sandbox with exec_command'
+		);
+	}
+	const script =
+		workspacePrelude(row) +
+		`set -e; mkdir -p "$(dirname "$1")"; printf '%s' "$CODEBAY_STDIN" | base64 -d > "$1"`;
+	const res = await execInContainer(execTargetFor(row), {
+		script,
+		args: ['write-file', path],
+		stdin: Buffer.from(content, 'utf8').toString('base64'),
+		timeoutMs: 30_000
+	});
+	if (!res.ok) throw new Error(res.error ?? 'could not write the file');
+}
+
+export interface DiffResult {
+	diff: string;
+	status: string;
+	branch: string;
+	truncated: boolean;
+}
+
+/** `--stat`-free full patch plus a porcelain summary, which is what an agent usually wants next. */
+export async function gitDiff(
+	row: InstanceRow,
+	opts: { base?: string; staged?: boolean } = {}
+): Promise<DiffResult> {
+	const range = opts.base ? ` ${quote(opts.base)}...HEAD` : opts.staged ? ' --staged' : '';
+	const [diff, status, branch] = await Promise.all([
+		execCommand(row, `git --no-pager diff${range}`),
+		execCommand(row, 'git status --short'),
+		execCommand(row, 'git rev-parse --abbrev-ref HEAD')
+	]);
+	if (diff.exitCode !== 0) throw new Error((diff.stderr || 'git diff failed').trim());
+	return {
+		diff: diff.stdout,
+		status: status.stdout,
+		branch: branch.stdout.trim(),
+		truncated: diff.truncated
+	};
+}
+
+export interface PushResult {
+	branch: string;
+	committed: boolean;
+	output: string;
+}
+
+/**
+ * The `github-credentials` injection has already authed git and `gh` inside the container, so this
+ * is a plain push — nothing here handles credentials.
+ */
+export async function gitPush(
+	row: InstanceRow,
+	opts: { branch?: string; commitMessage?: string; force?: boolean } = {}
+): Promise<PushResult> {
+	const current = (await must(row, 'git rev-parse --abbrev-ref HEAD')).trim();
+	const branch = opts.branch?.trim() || current;
+	if (!branch || branch === 'HEAD') {
+		throw new Error('the sandbox is on a detached HEAD — pass an explicit branch');
+	}
+
+	let committed = false;
+	if (opts.commitMessage) {
+		const dirty = await execCommand(row, 'git status --porcelain');
+		if (dirty.stdout.trim()) {
+			await must(row, `git add -A && git commit -m ${quote(opts.commitMessage)}`);
+			committed = true;
+		}
+	}
+
+	if (current !== branch) await must(row, `git checkout -B ${quote(branch)}`);
+
+	// --force-with-lease rather than --force: it still refuses to discard commits we never saw.
+	const force = opts.force ? ' --force-with-lease' : '';
+	const output = await must(
+		row,
+		`git push${force} -u origin HEAD:refs/heads/${quote(branch)} 2>&1`,
+		300
+	);
+	return { branch, committed, output: output.trim() };
+}
+
+export const PR_ATTRIBUTION_KEY = 'mcp_pr_attribution';
+
+/** The footer appended to an MCP-opened PR body when the setting is on. */
+export const PR_ATTRIBUTION =
+	'🤖 Written by Claude Code in a [Codebay](https://github.com/khromov/codebay) sandbox, driven over MCP.';
+
+/** Off unless explicitly enabled — an attribution line on someone's PR is theirs to opt into. */
+export function prAttributionEnabled(): boolean {
+	return getOption(PR_ATTRIBUTION_KEY) === '1';
+}
+
+/** Appends the footer, unless the body already carries it (a caller may have written its own). */
+export function withAttribution(body: string): string {
+	if (!prAttributionEnabled() || body.includes(PR_ATTRIBUTION)) return body;
+	return `${body.trimEnd()}\n\n---\n${PR_ATTRIBUTION}\n`;
+}
+
+export async function createPr(
+	row: InstanceRow,
+	opts: { title: string; body?: string; base?: string; draft?: boolean }
+): Promise<{ url: string }> {
+	const parts = [
+		'gh pr create',
+		`--title ${quote(opts.title)}`,
+		`--body ${quote(withAttribution(opts.body ?? ''))}`
+	];
+	if (opts.base) parts.push(`--base ${quote(opts.base)}`);
+	if (opts.draft) parts.push('--draft');
+	const out = await must(row, `${parts.join(' ')} 2>&1`, 300);
+	// gh prints the PR URL as its last line; anything else is progress chatter.
+	const url = out.trim().split('\n').filter(Boolean).at(-1) ?? '';
+	if (!url.startsWith('http')) throw new Error(out.trim() || 'gh did not return a PR url');
+	return { url };
+}

package/src/lib/upload.ts

@@ -0,0 +1,32 @@
+import { apiFetch } from '../api.ts';
+
+export interface UploadedFile {
+	name: string;
+	hostPath: string;
+	containerPath: string;
+	bytes: number;
+}
+
+/** Unknown MIME subtype → `.bin`, so a pasted image never round-trips with no extension at all. */
+function extFor(mimeType: string): string {
+	const subtype = mimeType.split('/')[1];
+	return subtype && /^[a-z0-9.+-]+$/i.test(subtype) ? subtype : 'bin';
+}
+
+/** Files from a drop or a paste; pasted images arrive nameless, so they get a timestamped one. */
+export function filesFrom(dt: DataTransfer | null): File[] {
+	if (!dt) return [];
+	return [...dt.files].map((f) =>
+		f.name ? f : new File([f], `pasted-${Date.now()}.${extFor(f.type)}`, { type: f.type })
+	);
+}
+
+export async function uploadFile(id: string, file: File): Promise<UploadedFile> {
+	const q = new URLSearchParams({ name: file.name });
+	const { file: saved } = await apiFetch<{ file: UploadedFile }>(
+		`/api/instances/${id}/upload?${q}`,
+		{ method: 'POST', headers: { 'Content-Type': 'application/octet-stream' }, body: file },
+		'Upload failed'
+	);
+	return saved;
+}

package/src/lib/uploads.server.ts

@@ -0,0 +1,164 @@
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { open, unlink, type FileHandle } from 'node:fs/promises';
+import { basename, join, posix, resolve, sep } from 'node:path';
+import { Mochi, apiError, json, type MochiRouteValue } from 'mochi-framework';
+import { getInstance, getOption, type InstanceRow } from './db.server.ts';
+
+export const UPLOAD_ENABLED_KEY = 'workspace_upload_enabled';
+
+/** Off until someone opts in — a write path into every workspace is not something to ship armed. */
+export function uploadEnabled(): boolean {
+	return getOption(UPLOAD_ENABLED_KEY) === '1';
+}
+
+/** The drop folder inside every workspace; git-excluded (MANAGER_GIT_EXCLUDES + its own .gitignore). */
+export const INBOX_DIR = 'codebay-inbox';
+
+/** App-level ceiling, independent of Bun's `maxRequestBodySize` — kept in one place so they can't drift. */
+export const UPLOAD_MAX_BYTES = 256 * 1024 * 1024;
+
+/**
+ * A bare filename only. `basename()` alone isn't enough to stop `../x` or `a/b` — a path with
+ * separators would silently resolve to a different (real) name than what it looks like it means,
+ * so any input `basename()` had to change is rejected outright rather than normalized.
+ */
+function hasControlChar(name: string): boolean {
+	for (let i = 0; i < name.length; i++) {
+		if (name.charCodeAt(i) < 0x20) return true;
+	}
+	return false;
+}
+
+export function safeUploadName(raw: string): string {
+	const trimmed = raw.trim();
+	const candidate = basename(trimmed);
+	if (!candidate || candidate === '.' || candidate === '..' || candidate.length > 200) {
+		throw new Error('invalid file name');
+	}
+	if (candidate !== trimmed || /[\\/]/.test(candidate) || hasControlChar(candidate)) {
+		throw new Error('invalid file name');
+	}
+	return candidate;
+}
+
+/** `name`, then `name-1.ext`, `name-2.ext`… — the candidates `openUnique` tries in order. */
+function* candidateNames(name: string): Generator<string> {
+	yield name;
+	const dot = name.lastIndexOf('.');
+	const stem = dot > 0 ? name.slice(0, dot) : name;
+	const ext = dot > 0 ? name.slice(dot) : '';
+	for (let n = 1; ; n++) yield `${stem}-${n}${ext}`;
+}
+
+/**
+ * Claims the first free candidate with an exclusive create, so nothing already in the inbox is ever
+ * overwritten. `wx` (O_CREAT|O_EXCL) also refuses to follow a symlink — even a dangling one, which
+ * an `existsSync` probe would report as free and a plain write would follow outside the workspace.
+ */
+export async function openUnique(
+	dir: string,
+	name: string
+): Promise<{ name: string; path: string; file: FileHandle }> {
+	for (const candidate of candidateNames(name)) {
+		const path = join(dir, candidate);
+		try {
+			return { name: candidate, path, file: await open(path, 'wx') };
+		} catch (err) {
+			if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err;
+		}
+	}
+	throw new Error('unreachable');
+}
+
+const INBOX_GITIGNORE = '*\n';
+// Earlier builds seeded this, whose negation left the folder itself showing in `git status`.
+const LEGACY_INBOX_GITIGNORE = '*\n!.gitignore\n';
+
+/** Self-excluding, so the inbox needs no entry in `MANAGER_GIT_EXCLUDES`-derived `.git/info/exclude`. */
+function seedInboxGitignore(inbox: string): void {
+	const path = join(inbox, '.gitignore');
+	const st = lstatSync(path, { throwIfNoEntry: false });
+	if (!st) {
+		try {
+			writeFileSync(path, INBOX_GITIGNORE, { flag: 'wx' });
+		} catch (err) {
+			if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err;
+		}
+	} else if (st.isFile() && readFileSync(path, 'utf8') === LEGACY_INBOX_GITIGNORE) {
+		writeFileSync(path, INBOX_GITIGNORE);
+	}
+}
+
+export interface SavedUpload {
+	name: string;
+	hostPath: string;
+	containerPath: string;
+	bytes: number;
+}
+
+/** Writes straight to the host bind mount — no `execInContainer`, no base64, no 128 KiB carrier cap. */
+export async function saveUpload(
+	row: InstanceRow,
+	rawName: string,
+	body: ReadableStream<Uint8Array> | Blob
+): Promise<SavedUpload> {
+	if (!existsSync(row.workspace_path)) throw new Error('Workspace folder is not on disk yet');
+	if (!row.remote_workspace_folder) throw new Error('Instance has not booted yet');
+	const inbox = join(row.workspace_path, INBOX_DIR);
+	// A symlinked inbox could redirect the write outside the workspace, so refuse anything but a real
+	// dir — `lstat`, not `existsSync`, which reports a dangling link as absent.
+	const st = lstatSync(inbox, { throwIfNoEntry: false });
+	if (st && !st.isDirectory()) throw new Error(`${INBOX_DIR} is not a directory`);
+	mkdirSync(inbox, { recursive: true });
+	seedInboxGitignore(inbox);
+	const safe = safeUploadName(rawName);
+	if (!resolve(inbox, safe).startsWith(inbox + sep)) throw new Error('invalid file name'); // belt and braces
+	const { name, path: dest, file } = await openUnique(inbox, safe);
+	// Streamed to disk chunk by chunk, so the body never has to fit in memory.
+	let written = 0;
+	try {
+		const stream = body instanceof Blob ? body.stream() : body;
+		for await (const chunk of stream) {
+			for (let off = 0; off < chunk.byteLength;) {
+				off += (await file.write(chunk, off)).bytesWritten;
+			}
+			written += chunk.byteLength;
+		}
+	} catch (err) {
+		// An aborted or over-cap body would otherwise leave a truncated file that looks complete.
+		await file.close();
+		await unlink(dest);
+		throw err;
+	}
+	await file.close();
+	return {
+		name,
+		hostPath: dest,
+		bytes: written,
+		// posix.join, never `join` — the container path is POSIX even when the host is Windows.
+		containerPath: posix.join(row.remote_workspace_folder, INBOX_DIR, name)
+	};
+}
+
+/**
+ * Raw body + `?name=` rather than multipart: nothing to parse, and the bytes stream straight to
+ * disk. Spread into the route table like `proxyRoutes`/`mcpRoutes`, and kept off `routes.ts`'s own
+ * `mutationRoute` helper (which always answers 200) because this needs 404 and 413.
+ */
+export const uploadRoutes: Record<string, MochiRouteValue> = {
+	'/api/instances/:id/upload': Mochi.api(async ({ method, params, url, request }) => {
+		if (method !== 'POST') return apiError(405, 'Method Not Allowed');
+		if (!uploadEnabled()) return apiError(404, 'Not Found');
+		const row = getInstance(params.id!);
+		if (!row) return apiError(404, 'Instance not found');
+		const len = Number(request.headers.get('content-length') ?? '0');
+		if (len > UPLOAD_MAX_BYTES) return apiError(413, `File exceeds ${UPLOAD_MAX_BYTES} bytes`);
+		if (!request.body) return apiError(400, 'Empty body');
+		try {
+			const saved = await saveUpload(row, url.searchParams.get('name') ?? '', request.body);
+			return json({ file: saved }, { status: 201 });
+		} catch (err) {
+			return apiError(400, (err as Error).message);
+		}
+	})
+};

package/src/mcp/routes.server.ts

@@ -0,0 +1,25 @@
+import { Mochi, apiError, type MochiRouteValue } from 'mochi-framework';
+import { MCP_PATH, mcpAuthOk, mcpEnabled } from '../lib/mcp-auth.server.ts';
+import { mcpTransport } from './server.server.ts';
+
+function unauthorized(): Response {
+	return new Response('Unauthorized', {
+		status: 401,
+		headers: { 'WWW-Authenticate': 'Bearer realm="Codebay MCP"' }
+	});
+}
+
+/**
+ * Mounted at `/mcp` rather than under `/api/` on purpose: `basicAuth` 403s every mutating `/api/`
+ * request without the `x-codebay-request` header, which no MCP client sends. The path is exempt
+ * from the Basic Auth gate and the CSRF filter, and authenticates by bearer token instead — the
+ * same trade the container bridge makes.
+ */
+export const mcpRoutes: Record<string, MochiRouteValue> = {
+	[MCP_PATH]: Mochi.api(async ({ request }) => {
+		// A 404 while disabled, so an install that never opted in looks like it has no MCP at all.
+		if (!mcpEnabled()) return apiError(404, 'Not Found');
+		if (!mcpAuthOk(request)) return unauthorized();
+		return (await mcpTransport().respond(request)) ?? apiError(404, 'Not Found');
+	})
+};

package/src/mcp/server.server.ts

@@ -0,0 +1,55 @@
+import { McpServer } from 'tmcp';
+import { ValibotJsonSchemaAdapter } from '@tmcp/adapter-valibot';
+import { HttpTransport } from '@tmcp/transport-http';
+import type * as v from 'valibot';
+import { APP_VERSION } from '../lib/config.server.ts';
+import { MCP_PATH } from '../lib/mcp-auth.server.ts';
+import { registerTools } from './tools.server.ts';
+
+const INSTRUCTIONS = `Codebay runs isolated devcontainer sandboxes, each with an authenticated Claude Code inside it.
+
+The normal flow is: create_sandbox (from a Git URL or a local folder) → poll get_sandbox until its
+status is "running" → run_agent with a prompt → poll get_run until it is done → get_diff to see what
+changed → git_push / create_pr to land it.
+
+Sandboxes are persistent and cost real resources: stop_sandbox one you will come back to (its
+workspace and run history stay; start_sandbox brings it back) and delete_sandbox one you are finished
+with. rebuild_sandbox recreates the container from the devcontainer config, keeping the workspace —
+it is what applies add_port_forward / remove_port_forward.
+A sandbox runs one agent at a time. Runs are asynchronous: run_agent returns a handle immediately and
+the work continues in the background, so never assume a run has finished without checking get_run.`;
+
+/** Built once and pinned, so dev-mode hot reload doesn't drop live MCP sessions on the floor. */
+interface McpRegistry {
+	transport: HttpTransport;
+}
+
+const globalForMcp = globalThis as unknown as { __codebayMcp?: McpRegistry };
+
+function build(): McpRegistry {
+	const server = new McpServer<v.GenericSchema>(
+		{
+			name: 'codebay',
+			version: APP_VERSION,
+			description: 'Create devcontainer sandboxes and run Claude Code in them.'
+		},
+		{
+			adapter: new ValibotJsonSchemaAdapter(),
+			instructions: INSTRUCTIONS,
+			capabilities: { tools: { listChanged: false } }
+		}
+	);
+	registerTools(server);
+	return {
+		transport: new HttpTransport(server, {
+			path: MCP_PATH,
+			// The bearer token is for programmatic clients; no browser page should be reaching this.
+			allowedOrigins: [],
+			cors: false
+		})
+	};
+}
+
+export function mcpTransport(): HttpTransport {
+	return (globalForMcp.__codebayMcp ??= build()).transport;
+}