codepiper 0.1.0

package/packages/daemon/src/api/bodyLimit.ts

@@ -0,0 +1,133 @@
+import {
+  isBodyTooLarge,
+  isImageBodyTooLarge,
+  MAX_BODY_SIZE,
+  MAX_IMAGE_BODY_SIZE,
+} from "../auth/authMiddleware";
+
+const BODY_METHODS = new Set(["POST", "PUT", "PATCH"]);
+const IMAGE_UPLOAD_PATH = /^\/(?:api\/)?sessions\/[a-zA-Z0-9-]+\/upload-image$/;
+const AUDIO_TRANSCRIBE_PATH = /^\/(?:api\/)?sessions\/[a-zA-Z0-9-]+\/terminal\/transcribe$/;
+
+class BodyTooLargeError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "BodyTooLargeError";
+  }
+}
+
+function isImageUploadPath(pathname: string): boolean {
+  return IMAGE_UPLOAD_PATH.test(pathname);
+}
+
+function isAudioTranscribePath(pathname: string): boolean {
+  return AUDIO_TRANSCRIBE_PATH.test(pathname);
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer;
+}
+
+async function readBodyWithLimit(req: Request, maxBytes: number): Promise<Uint8Array | null> {
+  if (!req.body) {
+    return null;
+  }
+
+  const reader = req.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (!value) {
+        continue;
+      }
+
+      total += value.byteLength;
+      if (total > maxBytes) {
+        try {
+          await reader.cancel();
+        } catch {
+          // best-effort cancellation
+        }
+        throw new BodyTooLargeError(`Request body exceeds ${maxBytes} bytes`);
+      }
+
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body;
+}
+
+/**
+ * Enforce request body limits:
+ * - image/audio upload routes: 10MB limit
+ * - all other write routes: 1MB limit, including chunked bodies without Content-Length.
+ *
+ * Returns either the original/rebuilt Request, or a 413 Response.
+ */
+export async function enforceRequestBodyLimit(
+  req: Request,
+  pathname: string
+): Promise<Request | Response> {
+  if (!BODY_METHODS.has(req.method.toUpperCase())) {
+    return req;
+  }
+
+  if (isImageUploadPath(pathname) || isAudioTranscribePath(pathname)) {
+    if (isImageBodyTooLarge(req)) {
+      return Response.json({ error: "Upload too large (max 10MB)" }, { status: 413 });
+    }
+    if (!req.headers.has("content-length")) {
+      try {
+        const body = await readBodyWithLimit(req, MAX_IMAGE_BODY_SIZE);
+        if (!body) {
+          return req;
+        }
+        return new Request(req, { body: toArrayBuffer(body) });
+      } catch (error) {
+        if (error instanceof BodyTooLargeError) {
+          return Response.json({ error: "Upload too large (max 10MB)" }, { status: 413 });
+        }
+        throw error;
+      }
+    }
+    return req;
+  }
+
+  if (isBodyTooLarge(req)) {
+    return Response.json({ error: "Request too large" }, { status: 413 });
+  }
+
+  // If Content-Length is present and already validated, no additional read is needed.
+  if (req.headers.has("content-length")) {
+    return req;
+  }
+
+  // No Content-Length (e.g. chunked): stream and enforce the same limit.
+  try {
+    const body = await readBodyWithLimit(req, MAX_BODY_SIZE);
+    if (!body) {
+      return req;
+    }
+    return new Request(req, { body: toArrayBuffer(body) });
+  } catch (error) {
+    if (error instanceof BodyTooLargeError) {
+      return Response.json({ error: "Request too large" }, { status: 413 });
+    }
+    throw error;
+  }
+}

package/packages/daemon/src/api/envSetRoutes.ts

@@ -0,0 +1,170 @@
+/**
+ * Environment Variable Set API route handlers
+ */
+
+import type { RouteContext } from "./routes";
+import { hasAnyDefinedField, jsonError, parseJsonBody } from "./routeUtils";
+import { getErrorMessage, isSqliteUniqueConstraintError } from "./sqliteErrors";
+
+/**
+ * GET /env-sets - List all env sets (with masked values)
+ */
+export async function handleListEnvSets(_req: Request, ctx: RouteContext): Promise<Response> {
+  const envSets = ctx.db.listEnvSets();
+  return Response.json({ envSets });
+}
+
+/**
+ * POST /env-sets - Create a new env set
+ */
+export async function handleCreateEnvSet(req: Request, ctx: RouteContext): Promise<Response> {
+  const parsed = await parseJsonBody(req);
+  if (!parsed.ok) {
+    return parsed.response;
+  }
+  const body = parsed.body as any;
+
+  if (!body.name || typeof body.name !== "string") {
+    return jsonError(400, "Missing required field: name");
+  }
+  if (body.name.trim().length === 0) {
+    return jsonError(400, "Field 'name' must not be empty");
+  }
+  if (body.name.length > 100) {
+    return jsonError(400, "Name too long (max 100 chars)");
+  }
+  if (
+    body.description !== undefined &&
+    body.description !== null &&
+    typeof body.description !== "string"
+  ) {
+    return jsonError(400, "Field 'description' must be a string or null");
+  }
+  if (!body.vars || typeof body.vars !== "object" || Array.isArray(body.vars)) {
+    return jsonError(400, "Missing required field: vars (must be an object)");
+  }
+
+  // Validate all keys and values are strings
+  for (const [key, value] of Object.entries(body.vars)) {
+    if (typeof key !== "string" || typeof value !== "string") {
+      return jsonError(400, `All env var keys and values must be strings. Invalid: ${key}`);
+    }
+  }
+
+  const id = crypto.randomUUID();
+
+  try {
+    ctx.db.createEnvSet({
+      id,
+      name: body.name,
+      description: body.description,
+      vars: body.vars,
+    });
+    const envSet = ctx.db.getEnvSet(id);
+    return Response.json({ envSet }, { status: 201 });
+  } catch (error) {
+    const msg = getErrorMessage(error);
+    if (isSqliteUniqueConstraintError(error)) {
+      return jsonError(409, `Env set name already exists: ${body.name}`);
+    }
+    return jsonError(500, msg);
+  }
+}
+
+/**
+ * GET /env-sets/:id - Get a specific env set (with masked values)
+ */
+export async function handleGetEnvSet(
+  _req: Request,
+  ctx: RouteContext,
+  envSetId: string
+): Promise<Response> {
+  const envSet = ctx.db.getEnvSet(envSetId);
+  if (!envSet) {
+    return jsonError(404, `Env set not found: ${envSetId}`);
+  }
+  return Response.json({ envSet });
+}
+
+/**
+ * PUT /env-sets/:id - Update an env set
+ */
+export async function handleUpdateEnvSet(
+  req: Request,
+  ctx: RouteContext,
+  envSetId: string
+): Promise<Response> {
+  const parsed = await parseJsonBody(req);
+  if (!parsed.ok) {
+    return parsed.response;
+  }
+  const body = parsed.body as any;
+
+  const existing = ctx.db.getEnvSet(envSetId);
+  if (!existing) {
+    return jsonError(404, `Env set not found: ${envSetId}`);
+  }
+
+  if (body.name !== undefined && typeof body.name !== "string") {
+    return jsonError(400, "name must be a string");
+  }
+  if (body.name !== undefined && body.name.trim().length === 0) {
+    return jsonError(400, "name must not be empty");
+  }
+  if (body.name !== undefined && body.name.length > 100) {
+    return jsonError(400, "Name too long (max 100 chars)");
+  }
+  if (
+    body.description !== undefined &&
+    body.description !== null &&
+    typeof body.description !== "string"
+  ) {
+    return jsonError(400, "description must be a string or null");
+  }
+  if (body.vars !== undefined) {
+    if (typeof body.vars !== "object" || Array.isArray(body.vars)) {
+      return jsonError(400, "vars must be an object");
+    }
+    for (const [key, value] of Object.entries(body.vars)) {
+      if (typeof key !== "string" || typeof value !== "string") {
+        return jsonError(400, `All env var keys and values must be strings. Invalid: ${key}`);
+      }
+    }
+  }
+  if (!hasAnyDefinedField(body, ["name", "description", "vars"])) {
+    return jsonError(422, "At least one field must be provided: name, description, or vars");
+  }
+
+  try {
+    ctx.db.updateEnvSet(envSetId, {
+      name: body.name,
+      description: body.description,
+      vars: body.vars,
+    });
+    const envSet = ctx.db.getEnvSet(envSetId);
+    return Response.json({ envSet });
+  } catch (error) {
+    const msg = getErrorMessage(error);
+    if (isSqliteUniqueConstraintError(error)) {
+      return jsonError(409, `Env set name already exists: ${body.name}`);
+    }
+    return jsonError(500, msg);
+  }
+}
+
+/**
+ * DELETE /env-sets/:id - Delete an env set
+ */
+export async function handleDeleteEnvSet(
+  _req: Request,
+  ctx: RouteContext,
+  envSetId: string
+): Promise<Response> {
+  const existing = ctx.db.getEnvSet(envSetId);
+  if (!existing) {
+    return jsonError(404, `Env set not found: ${envSetId}`);
+  }
+
+  ctx.db.deleteEnvSet(envSetId);
+  return Response.json({ success: true });
+}

package/packages/daemon/src/api/gitRoutes.ts

@@ -0,0 +1,409 @@
+/**
+ * Git API route handlers
+ *
+ * Provides git status, log, diff, file content, and staging operations
+ * scoped to a session's working directory.
+ */
+
+import { GitUtils, validateFilePath, validateGitRef } from "../git/gitUtils";
+import type { RouteContext } from "./routes";
+
+const IMAGE_MIME_TYPES: Record<string, string> = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  ico: "image/x-icon",
+  bmp: "image/bmp",
+  avif: "image/avif",
+  // SVG intentionally excluded — serving as image/svg+xml enables XSS via inline scripts
+};
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer;
+}
+
+async function getSessionCwd(
+  ctx: RouteContext,
+  sessionId: string
+): Promise<{ cwd: string } | Response> {
+  const session = ctx.sessionManager.getSession(sessionId) ?? ctx.db.getSession(sessionId);
+  if (!session) {
+    return Response.json({ error: `Session not found: ${sessionId}` }, { status: 404 });
+  }
+  return { cwd: session.cwd };
+}
+
+async function requireGitRepo(cwd: string): Promise<Response | null> {
+  const isRepo = await GitUtils.isGitRepo(cwd);
+  if (!isRepo) {
+    return Response.json({ error: "Session directory is not a git repository" }, { status: 400 });
+  }
+  return null;
+}
+
+/**
+ * Shared setup for git file endpoints: resolves session cwd, checks git repo,
+ * and extracts/validates ref + path query params.
+ */
+async function resolveGitFileParams(
+  req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<{ cwd: string; ref: string; filePath: string } | Response> {
+  const result = await getSessionCwd(ctx, sessionId);
+  if (result instanceof Response) return result;
+
+  const repoCheck = await requireGitRepo(result.cwd);
+  if (repoCheck) return repoCheck;
+
+  const url = new URL(req.url);
+  const ref = url.searchParams.get("ref");
+  const filePath = url.searchParams.get("path");
+
+  if (!(ref && filePath)) {
+    return Response.json({ error: "Missing required query params: ref and path" }, { status: 400 });
+  }
+
+  try {
+    validateGitRef(ref);
+    validateFilePath(filePath);
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Invalid input";
+    return Response.json({ error: msg }, { status: 400 });
+  }
+
+  return { cwd: result.cwd, ref, filePath };
+}
+
+/**
+ * GET /sessions/:id/git/status
+ */
+export async function handleGitStatus(
+  _req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const result = await getSessionCwd(ctx, sessionId);
+  if (result instanceof Response) return result;
+
+  const repoCheck = await requireGitRepo(result.cwd);
+  if (repoCheck) return repoCheck;
+
+  try {
+    const [status, branch] = await Promise.all([
+      GitUtils.getStatus(result.cwd),
+      GitUtils.getCurrentBranch(result.cwd),
+    ]);
+    return Response.json({ status, branch });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}
+
+/**
+ * GET /sessions/:id/git/branches
+ */
+export async function handleGitBranches(
+  _req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const result = await getSessionCwd(ctx, sessionId);
+  if (result instanceof Response) return result;
+
+  const repoCheck = await requireGitRepo(result.cwd);
+  if (repoCheck) return repoCheck;
+
+  try {
+    const [branches, currentBranch] = await Promise.all([
+      GitUtils.listBranches(result.cwd),
+      GitUtils.getCurrentBranch(result.cwd),
+    ]);
+    return Response.json({ branches, currentBranch });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}
+
+/**
+ * GET /sessions/:id/git/log?limit=50
+ */
+export async function handleGitLog(
+  req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const result = await getSessionCwd(ctx, sessionId);
+  if (result instanceof Response) return result;
+
+  const repoCheck = await requireGitRepo(result.cwd);
+  if (repoCheck) return repoCheck;
+
+  const url = new URL(req.url);
+  const limit = Number.parseInt(url.searchParams.get("limit") || "50", 10);
+
+  try {
+    const log = await GitUtils.getLog(result.cwd, { limit });
+    return Response.json({ log });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}
+
+/**
+ * GET /sessions/:id/git/diff?staged=true&commit=abc&commitA=x&commitB=y&path=file.ts
+ */
+export async function handleGitDiff(
+  req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const result = await getSessionCwd(ctx, sessionId);
+  if (result instanceof Response) return result;
+
+  const repoCheck = await requireGitRepo(result.cwd);
+  if (repoCheck) return repoCheck;
+
+  const url = new URL(req.url);
+  const staged = url.searchParams.get("staged") === "true";
+  const commit = url.searchParams.get("commit");
+  const commitA = url.searchParams.get("commitA");
+  const commitB = url.searchParams.get("commitB");
+  const filePath = url.searchParams.get("path") || undefined;
+
+  try {
+    // Validate refs and paths
+    if (commit) validateGitRef(commit);
+    if (commitA) validateGitRef(commitA);
+    if (commitB) validateGitRef(commitB);
+    if (filePath) validateFilePath(filePath);
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Invalid input";
+    return Response.json({ error: msg }, { status: 400 });
+  }
+
+  try {
+    let diff: string;
+
+    if (commit) {
+      diff = await GitUtils.getCommitDiff(result.cwd, commit, filePath);
+    } else {
+      diff = await GitUtils.getDiff(result.cwd, {
+        staged,
+        commitA: commitA || undefined,
+        commitB: commitB || undefined,
+        path: filePath,
+      });
+    }
+
+    return Response.json({ diff });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}
+
+/**
+ * GET /sessions/:id/git/file?ref=HEAD&path=src/foo.ts
+ * Use ref=WORKING_TREE to read the file from the on-disk working tree.
+ */
+export async function handleGitFile(
+  req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const params = await resolveGitFileParams(req, ctx, sessionId);
+  if (params instanceof Response) return params;
+
+  try {
+    const content =
+      params.ref === "WORKING_TREE"
+        ? await GitUtils.getFileFromWorkingTree(params.cwd, params.filePath)
+        : await GitUtils.getFileAtRef(params.cwd, params.ref, params.filePath);
+    return Response.json({ content });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}
+
+/**
+ * GET /sessions/:id/git/diff-stat?ref=abc123[&base=main]
+ */
+export async function handleGitDiffStat(
+  req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const result = await getSessionCwd(ctx, sessionId);
+  if (result instanceof Response) return result;
+
+  const repoCheck = await requireGitRepo(result.cwd);
+  if (repoCheck) return repoCheck;
+
+  const url = new URL(req.url);
+  const ref = url.searchParams.get("ref");
+  const base = url.searchParams.get("base");
+
+  // Branch comparison mode: base...ref
+  if (base) {
+    try {
+      validateGitRef(base);
+      if (ref) validateGitRef(ref);
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : "Invalid input";
+      return Response.json({ error: msg }, { status: 400 });
+    }
+    try {
+      const files = await GitUtils.getDiffStatBetweenRefs(result.cwd, base, ref || "HEAD");
+      return Response.json({ files });
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : "Unknown error";
+      return Response.json({ error: msg }, { status: 500 });
+    }
+  }
+
+  // Single-ref mode (commit vs parent)
+  if (!ref) {
+    return Response.json({ error: "Missing required query param: ref" }, { status: 400 });
+  }
+
+  try {
+    validateGitRef(ref);
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Invalid input";
+    return Response.json({ error: msg }, { status: 400 });
+  }
+
+  try {
+    const files = await GitUtils.getDiffStat(result.cwd, ref);
+    return Response.json({ files });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}
+
+/**
+ * GET /sessions/:id/git/file-raw?ref=HEAD&path=src/image.png
+ * Returns raw file bytes with appropriate Content-Type.
+ */
+export async function handleGitFileRaw(
+  req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const params = await resolveGitFileParams(req, ctx, sessionId);
+  if (params instanceof Response) return params;
+
+  try {
+    const data = await GitUtils.getFileAtRefRaw(params.cwd, params.ref, params.filePath);
+    const ext = params.filePath.split(".").pop()?.toLowerCase() || "";
+    const contentType = IMAGE_MIME_TYPES[ext] || "application/octet-stream";
+    return new Response(toArrayBuffer(data), {
+      headers: { "Content-Type": contentType, "Cache-Control": "no-cache" },
+    });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}
+
+/**
+ * POST /sessions/:id/git/stage — body: { paths: string[] }
+ */
+export async function handleGitStage(
+  req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const result = await getSessionCwd(ctx, sessionId);
+  if (result instanceof Response) return result;
+
+  const repoCheck = await requireGitRepo(result.cwd);
+  if (repoCheck) return repoCheck;
+
+  let body: any;
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ error: "Invalid JSON in request body" }, { status: 400 });
+  }
+
+  if (!Array.isArray(body.paths) || body.paths.length === 0) {
+    return Response.json(
+      { error: "Missing required field: paths (non-empty array)" },
+      { status: 400 }
+    );
+  }
+
+  try {
+    for (const p of body.paths) {
+      if (typeof p !== "string") throw new Error("Each path must be a string");
+      validateFilePath(p);
+    }
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Invalid input";
+    return Response.json({ error: msg }, { status: 400 });
+  }
+
+  try {
+    await GitUtils.stageFiles(result.cwd, body.paths);
+    return Response.json({ success: true });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}
+
+/**
+ * POST /sessions/:id/git/unstage — body: { paths: string[] }
+ */
+export async function handleGitUnstage(
+  req: Request,
+  ctx: RouteContext,
+  sessionId: string
+): Promise<Response> {
+  const result = await getSessionCwd(ctx, sessionId);
+  if (result instanceof Response) return result;
+
+  const repoCheck = await requireGitRepo(result.cwd);
+  if (repoCheck) return repoCheck;
+
+  let body: any;
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ error: "Invalid JSON in request body" }, { status: 400 });
+  }
+
+  if (!Array.isArray(body.paths) || body.paths.length === 0) {
+    return Response.json(
+      { error: "Missing required field: paths (non-empty array)" },
+      { status: 400 }
+    );
+  }
+
+  try {
+    for (const p of body.paths) {
+      if (typeof p !== "string") throw new Error("Each path must be a string");
+      validateFilePath(p);
+    }
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Invalid input";
+    return Response.json({ error: msg }, { status: 400 });
+  }
+
+  try {
+    await GitUtils.unstageFiles(result.cwd, body.paths);
+    return Response.json({ success: true });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "Unknown error";
+    return Response.json({ error: msg }, { status: 500 });
+  }
+}