conductor-oss 0.2.15 → 0.2.16

package/web/.next/standalone/packages/web/src/app/api/access/route.ts

@@ -0,0 +1,214 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { readFile, writeFile } from "node:fs/promises";
+import { parse, stringify } from "yaml";
+import type { DashboardAccessConfig, DashboardRoleBindings } from "@conductor-oss/core/types";
+import { getDashboardAccess, guardApiAccess, guardApiActionAccess } from "@/lib/auth";
+import { getServices, invalidateServicesCache } from "@/lib/services";
+import { normalizeRootProjectPaths } from "@/lib/projectConfigSync";
+
+export const dynamic = "force-dynamic";
+
+type MutableConfig = Record<string, unknown>;
+
+type AccessPatchBody = {
+  requireAuth?: unknown;
+  defaultRole?: unknown;
+  trustedHeaders?: unknown;
+  roles?: unknown;
+};
+
+function toObject(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return { ...(value as Record<string, unknown>) };
+}
+
+function asOptionalRole(value: unknown): DashboardAccessConfig["defaultRole"] | undefined {
+  if (value === "viewer" || value === "operator" || value === "admin") {
+    return value;
+  }
+  return undefined;
+}
+
+function normalizeStringList(value: unknown): string[] {
+  if (Array.isArray(value)) {
+    return value
+      .filter((item): item is string => typeof item === "string")
+      .map((item) => item.trim())
+      .filter(Boolean);
+  }
+  if (typeof value !== "string") return [];
+  return value
+    .split(/[\n,]+/g)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function normalizeRoles(value: unknown): DashboardRoleBindings | undefined {
+  const root = toObject(value);
+  const next: DashboardRoleBindings = {};
+
+  const viewers = normalizeStringList(root["viewers"]);
+  const operators = normalizeStringList(root["operators"]);
+  const admins = normalizeStringList(root["admins"]);
+  const viewerDomains = normalizeStringList(root["viewerDomains"]);
+  const operatorDomains = normalizeStringList(root["operatorDomains"]);
+  const adminDomains = normalizeStringList(root["adminDomains"]);
+
+  if (viewers.length > 0) next.viewers = viewers;
+  if (operators.length > 0) next.operators = operators;
+  if (admins.length > 0) next.admins = admins;
+  if (viewerDomains.length > 0) next.viewerDomains = viewerDomains;
+  if (operatorDomains.length > 0) next.operatorDomains = operatorDomains;
+  if (adminDomains.length > 0) next.adminDomains = adminDomains;
+
+  return Object.keys(next).length > 0 ? next : undefined;
+}
+
+function normalizeAccessConfig(value: unknown): DashboardAccessConfig {
+  const root = toObject(value);
+  const trustedHeaders = toObject(root["trustedHeaders"]);
+  const defaultRole = asOptionalRole(root["defaultRole"]);
+
+  const next: DashboardAccessConfig = {
+    requireAuth: root["requireAuth"] === true,
+    trustedHeaders: {
+      enabled: trustedHeaders["enabled"] === true,
+      provider:
+        trustedHeaders["provider"] === "generic"
+          ? "generic"
+          : "cloudflare-access",
+      emailHeader:
+        (typeof trustedHeaders["emailHeader"] === "string" && trustedHeaders["emailHeader"].trim().length > 0
+          ? trustedHeaders["emailHeader"].trim()
+          : "Cf-Access-Authenticated-User-Email"),
+      jwtHeader:
+        (typeof trustedHeaders["jwtHeader"] === "string" && trustedHeaders["jwtHeader"].trim().length > 0
+          ? trustedHeaders["jwtHeader"].trim()
+          : "Cf-Access-Jwt-Assertion"),
+    },
+  };
+
+  if (typeof trustedHeaders["teamDomain"] === "string" && trustedHeaders["teamDomain"].trim().length > 0) {
+    next.trustedHeaders!.teamDomain = trustedHeaders["teamDomain"].trim();
+  }
+
+  if (typeof trustedHeaders["audience"] === "string" && trustedHeaders["audience"].trim().length > 0) {
+    next.trustedHeaders!.audience = trustedHeaders["audience"].trim();
+  }
+
+  if (defaultRole) {
+    next.defaultRole = defaultRole;
+  }
+
+  const roles = normalizeRoles(root["roles"]);
+  if (roles) {
+    next.roles = roles;
+  }
+
+  return next;
+}
+
+export async function GET(request: NextRequest) {
+  const denied = await guardApiAccess(request, "viewer");
+  if (denied) return denied;
+
+  try {
+    const { config } = await getServices();
+    const access = normalizeAccessConfig(config.access);
+    const current = await getDashboardAccess(request);
+
+    return NextResponse.json({
+      access,
+      current: {
+        authenticated: current.authenticated,
+        role: current.role ?? null,
+        email: current.email ?? null,
+        provider: current.provider ?? null,
+      },
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Failed to load access settings";
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}
+
+export async function PUT(request: NextRequest) {
+  const denied = await guardApiAccess(request, "admin");
+  if (denied) return denied;
+  const deniedAction = guardApiActionAccess(request);
+  if (deniedAction) return deniedAction;
+
+  const body = (await request.json().catch(() => null)) as AccessPatchBody | null;
+  if (!body || typeof body !== "object") {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  try {
+    const { config } = await getServices();
+    const configPath = config.configPath;
+    if (!configPath) {
+      return NextResponse.json({ error: "Unable to resolve conductor config path" }, { status: 500 });
+    }
+
+    const originalConfigRaw = await readFile(configPath, "utf8");
+    const parsed = (parse(originalConfigRaw) ?? {}) as MutableConfig;
+    const nextRoot: MutableConfig =
+      parsed && typeof parsed === "object" && !Array.isArray(parsed)
+        ? { ...parsed }
+        : {};
+
+    const nextAccess = normalizeAccessConfig(nextRoot["access"]);
+
+    if (typeof body.requireAuth === "boolean") {
+      nextAccess.requireAuth = body.requireAuth;
+    }
+
+    if (body.defaultRole !== undefined) {
+      nextAccess.defaultRole = asOptionalRole(body.defaultRole);
+    }
+
+    if (body.trustedHeaders !== undefined) {
+      const nextTrusted = toObject(body.trustedHeaders);
+      nextAccess.trustedHeaders = {
+        enabled: nextTrusted["enabled"] === true,
+        emailHeader:
+          (typeof nextTrusted["emailHeader"] === "string" && nextTrusted["emailHeader"].trim().length > 0
+            ? nextTrusted["emailHeader"].trim()
+            : "Cf-Access-Authenticated-User-Email"),
+      };
+    }
+
+    if (body.roles !== undefined) {
+      nextAccess.roles = normalizeRoles(body.roles);
+    }
+
+    nextRoot["access"] = nextAccess;
+    await normalizeRootProjectPaths(nextRoot);
+
+    const updatedYaml = stringify(nextRoot, { lineWidth: 0 });
+    await writeFile(configPath, updatedYaml, "utf8");
+
+    try {
+      invalidateServicesCache("access updated");
+      await getServices();
+    } catch (err) {
+      await writeFile(configPath, originalConfigRaw, "utf8");
+      invalidateServicesCache("access update rollback");
+      throw err;
+    }
+
+    const current = await getDashboardAccess(request);
+    return NextResponse.json({
+      access: nextAccess,
+      current: {
+        authenticated: current.authenticated,
+        role: current.role ?? null,
+        email: current.email ?? null,
+        provider: current.provider ?? null,
+      },
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Failed to update access settings";
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

package/web/.next/standalone/packages/web/src/app/api/agents/route.ts

@@ -0,0 +1,223 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { NextResponse } from "next/server";
+import { getRuntimeAgentModelCatalog } from "@/lib/runtimeAgentModels";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const execFileAsync = promisify(execFile);
+const AGENTS_RESPONSE_TTL_MS = 30_000;
+const AGENT_READINESS_TTL_MS = 60_000;
+const AGENT_READY_CHECK_TIMEOUT_MS = 500;
+
+type AgentPayload = {
+  name?: unknown;
+  binary?: unknown;
+  ready?: unknown;
+  installed?: unknown;
+  runtimeModelCatalog?: unknown;
+  [key: string]: unknown;
+};
+
+type CachedResponse = {
+  body: unknown;
+  status: number;
+  expiresAt: number;
+};
+
+type CachedReadiness = {
+  ready: boolean;
+  installed: boolean;
+  expiresAt: number;
+};
+
+let cachedAgentsResponse: CachedResponse | null = null;
+let inFlightAgentsResponse: Promise<CachedResponse> | null = null;
+const readinessCache = new Map<string, CachedReadiness>();
+
+function normalizeAgentsPayload(payload: unknown): AgentPayload[] {
+  if (Array.isArray(payload)) {
+    return payload as AgentPayload[];
+  }
+
+  if (
+    payload
+    && typeof payload === "object"
+    && "agents" in payload
+    && Array.isArray((payload as { agents?: unknown }).agents)
+  ) {
+    return (payload as { agents: AgentPayload[] }).agents;
+  }
+
+  return [];
+}
+
+function resolveBackendUrl(): string {
+  const explicit = process.env.CONDUCTOR_BACKEND_URL?.trim();
+  if (explicit) {
+    return explicit.replace(/\/+$/, "");
+  }
+
+  const port = process.env.CONDUCTOR_BACKEND_PORT?.trim() || "4748";
+  return `http://127.0.0.1:${port}`;
+}
+
+const ALLOWED_AGENT_BINARIES = new Set([
+  "claude",
+  "codex",
+  "gemini",
+  "gh",
+  "opencode",
+  "qwen",
+  "aider",
+  "cursor",
+]);
+
+function isSafeBinary(binary: string): boolean {
+  const basename = binary.split("/").pop()?.split("\\").pop() ?? "";
+  return ALLOWED_AGENT_BINARIES.has(basename);
+}
+
+function resolveVersionArgs(agentName: string): string[] {
+  switch (agentName) {
+    case "opencode":
+      return ["version"];
+    default:
+      return ["--version"];
+  }
+}
+
+async function resolveAgentReadiness(agent: AgentPayload): Promise<{ ready: boolean; installed: boolean }> {
+  const name = typeof agent.name === "string" ? agent.name.trim() : "";
+  const binary = typeof agent.binary === "string" ? agent.binary.trim() : "";
+
+  if (!name || !binary) {
+    const ready = Boolean(agent.ready ?? agent.installed ?? false);
+    return { ready, installed: ready };
+  }
+
+  if (!isSafeBinary(binary)) {
+    return { ready: false, installed: false };
+  }
+
+  const cacheKey = `${name}:${binary}`;
+  const now = Date.now();
+  const cached = readinessCache.get(cacheKey);
+  if (cached && cached.expiresAt > now) {
+    return { ready: cached.ready, installed: cached.installed };
+  }
+
+  let ready = false;
+  try {
+    await execFileAsync(binary, resolveVersionArgs(name), {
+      encoding: "utf8",
+      timeout: AGENT_READY_CHECK_TIMEOUT_MS,
+    });
+    ready = true;
+  } catch {
+    ready = false;
+  }
+
+  const next = {
+    ready,
+    installed: ready,
+    expiresAt: now + AGENT_READINESS_TTL_MS,
+  };
+  readinessCache.set(cacheKey, next);
+  return { ready: next.ready, installed: next.installed };
+}
+
+async function buildAgentsResponse(): Promise<CachedResponse> {
+  const backendUrl = resolveBackendUrl();
+
+  let response: Response;
+  response = await fetch(`${backendUrl}/api/agents`, {
+    cache: "no-store",
+    headers: { Accept: "application/json" },
+  });
+
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    return {
+      body: payload ?? { error: `Failed to fetch agents: ${response.status}` },
+      status: response.status,
+      expiresAt: Date.now() + 5_000,
+    };
+  }
+
+  const agents = normalizeAgentsPayload(payload);
+  const enrichedAgents = await Promise.all(agents.map(async (agent) => {
+    const name = typeof agent.name === "string" ? agent.name.trim() : "";
+    const { ready, installed } = await resolveAgentReadiness(agent);
+    const runtimeModelCatalog = ready && name ? await getRuntimeAgentModelCatalog(name) : null;
+    return {
+      ...agent,
+      ready,
+      installed,
+      runtimeModelCatalog,
+    };
+  }));
+
+  if (Array.isArray(payload)) {
+    return {
+      body: enrichedAgents,
+      status: response.status,
+      expiresAt: Date.now() + AGENTS_RESPONSE_TTL_MS,
+    };
+  }
+
+  if (payload && typeof payload === "object") {
+    return {
+      body: {
+        ...(payload as Record<string, unknown>),
+        agents: enrichedAgents,
+      },
+      status: response.status,
+      expiresAt: Date.now() + AGENTS_RESPONSE_TTL_MS,
+    };
+  }
+
+  return {
+    body: { agents: enrichedAgents },
+    status: response.status,
+    expiresAt: Date.now() + AGENTS_RESPONSE_TTL_MS,
+  };
+}
+
+export async function GET(): Promise<NextResponse> {
+  const now = Date.now();
+  if (cachedAgentsResponse && cachedAgentsResponse.expiresAt > now) {
+    return NextResponse.json(cachedAgentsResponse.body, { status: cachedAgentsResponse.status });
+  }
+
+  if (!inFlightAgentsResponse) {
+    inFlightAgentsResponse = buildAgentsResponse()
+      .then((result) => {
+        cachedAgentsResponse = result;
+        return result;
+      })
+      .finally(() => {
+        inFlightAgentsResponse = null;
+      });
+  }
+
+  if (cachedAgentsResponse) {
+    return NextResponse.json(cachedAgentsResponse.body, {
+      status: cachedAgentsResponse.status,
+      headers: { "x-conductor-cache": "stale" },
+    });
+  }
+
+  try {
+    const response = await inFlightAgentsResponse;
+    return NextResponse.json(response.body, { status: response.status });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error: error instanceof Error ? error.message : "Failed to reach agent backend",
+      },
+      { status: 502 },
+    );
+  }
+}

package/web/.next/standalone/packages/web/src/app/api/attachments/route.ts

@@ -0,0 +1,169 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { randomBytes } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, relative, resolve, sep } from "node:path";
+import type { OrchestratorConfig } from "@conductor-oss/core";
+import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
+import { getServices } from "@/lib/services";
+
+export const dynamic = "force-dynamic";
+
+const MAX_UPLOAD_FILES = 20;
+const MAX_UPLOAD_BYTES = 25 * 1024 * 1024; // 25MB per file
+
+const IMAGE_EXTENSIONS = new Set([
+  ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp", ".ico", ".tiff",
+]);
+
+function asNonEmptyString(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function expandHome(value: string): string {
+  if (value.startsWith("~/")) {
+    return resolve(homedir(), value.slice(2));
+  }
+  return resolve(value);
+}
+
+function resolveWorkspacePath(config: OrchestratorConfig): string {
+  if (process.env["CONDUCTOR_WORKSPACE"]?.trim()) {
+    return expandHome(process.env["CONDUCTOR_WORKSPACE"]);
+  }
+  if (config.configPath) {
+    return dirname(config.configPath);
+  }
+  return resolve(process.cwd());
+}
+
+function normalizeToken(value: string): string {
+  const input = value.trim().toLowerCase();
+  let out = "";
+  let prevDash = false;
+  for (const ch of input) {
+    const code = ch.charCodeAt(0);
+    const isDigit = code >= 48 && code <= 57;
+    const isLowerAlpha = code >= 97 && code <= 122;
+    const isSafe = isDigit || isLowerAlpha || ch === "." || ch === "_";
+    if (isSafe) {
+      out += ch;
+      prevDash = false;
+      continue;
+    }
+    if (!prevDash && out.length > 0) {
+      out += "-";
+      prevDash = true;
+    }
+  }
+  while (out.endsWith("-")) out = out.slice(0, -1);
+  return out || "project";
+}
+
+function sanitizeFileName(value: string): string {
+  const trimmed = value.trim();
+  if (!trimmed) return "upload.bin";
+  const normalized = trimmed
+    .replaceAll("\\", "/")
+    .split("/")
+    .filter(Boolean)
+    .pop() ?? "upload.bin";
+  const safe = normalized
+    .replace(/[^A-Za-z0-9._-]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^\.+/, "")
+    .replace(/^-+/, "");
+  return safe || "upload.bin";
+}
+
+function isImagePath(path: string): boolean {
+  const lower = path.toLowerCase();
+  for (const ext of IMAGE_EXTENSIONS) {
+    if (lower.endsWith(ext)) return true;
+  }
+  return false;
+}
+
+export async function POST(request: NextRequest) {
+  const denied = await guardApiAccess(request, "operator");
+  if (denied) return denied;
+  const deniedAction = guardApiActionAccess(request);
+  if (deniedAction) return deniedAction;
+
+  try {
+    const form = await request.formData();
+    const projectId = asNonEmptyString(form.get("projectId"));
+    if (!projectId) {
+      return NextResponse.json({ error: "projectId is required" }, { status: 400 });
+    }
+
+    const incoming = form.getAll("files").filter((item): item is File => item instanceof File);
+    if (incoming.length === 0) {
+      return NextResponse.json({ error: "No files uploaded" }, { status: 400 });
+    }
+    if (incoming.length > MAX_UPLOAD_FILES) {
+      return NextResponse.json(
+        { error: `Too many files. Max ${MAX_UPLOAD_FILES} files per request.` },
+        { status: 400 },
+      );
+    }
+
+    const { config } = await getServices();
+    if (!config.projects[projectId]) {
+      return NextResponse.json({ error: `Unknown project: ${projectId}` }, { status: 404 });
+    }
+
+    const workspaceRoot = resolveWorkspacePath(config);
+    const projectSegment = normalizeToken(projectId);
+    const targetDir = resolve(workspaceRoot, "attachments", projectSegment);
+    const workspacePrefix = workspaceRoot.endsWith(sep) ? workspaceRoot : `${workspaceRoot}${sep}`;
+    if (targetDir !== workspaceRoot && !targetDir.startsWith(workspacePrefix)) {
+      return NextResponse.json({ error: "Upload path escapes workspace" }, { status: 400 });
+    }
+    await mkdir(targetDir, { recursive: true });
+
+    const uploaded: Array<{
+      path: string;
+      name: string;
+      size: number;
+      mimeType: string | null;
+      kind: "image" | "file";
+    }> = [];
+
+    for (const [index, file] of incoming.entries()) {
+      if (file.size > MAX_UPLOAD_BYTES) {
+        return NextResponse.json(
+          { error: `File "${file.name}" exceeds 25MB limit.` },
+          { status: 413 },
+        );
+      }
+      const safeName = sanitizeFileName(file.name);
+      const uniquePrefix = `${Date.now()}-${index}-${randomBytes(3).toString("hex")}`;
+      const fileName = `${uniquePrefix}-${safeName}`;
+      const absolutePath = resolve(targetDir, fileName);
+      if (absolutePath !== workspaceRoot && !absolutePath.startsWith(workspacePrefix)) {
+        return NextResponse.json({ error: "Resolved upload path escapes workspace" }, { status: 400 });
+      }
+
+      const bytes = Buffer.from(await file.arrayBuffer());
+      await writeFile(absolutePath, bytes);
+      const relPath = relative(workspaceRoot, absolutePath).replaceAll("\\", "/");
+      uploaded.push({
+        path: relPath,
+        name: file.name || safeName,
+        size: file.size,
+        mimeType: file.type || null,
+        kind: isImagePath(relPath) ? "image" : "file",
+      });
+    }
+
+    return NextResponse.json({ files: uploaded }, { status: 201 });
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Failed to upload files" },
+      { status: 500 },
+    );
+  }
+}

package/web/.next/standalone/packages/web/src/app/api/auth/session/route.ts

@@ -0,0 +1,54 @@
+import { type NextRequest, NextResponse } from "next/server";
+import {
+  BUILTIN_REMOTE_SESSION_COOKIE,
+  createBuiltinRemoteSessionValue,
+  getBuiltinRemoteSessionCookieOptions,
+  isBuiltinRemoteAuthEnabled,
+  isValidBuiltinAccessToken,
+} from "@/lib/remoteAuth";
+
+type SessionRequestBody = {
+  token?: unknown;
+};
+
+function clearSession(response: NextResponse): void {
+  response.cookies.set(BUILTIN_REMOTE_SESSION_COOKIE, "", {
+    ...getBuiltinRemoteSessionCookieOptions(false),
+    maxAge: 0,
+  });
+}
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  if (!isBuiltinRemoteAuthEnabled()) {
+    return NextResponse.json({ error: "Built-in remote auth is not enabled" }, { status: 404 });
+  }
+
+  const body = (await request.json().catch(() => null)) as SessionRequestBody | null;
+  const token = typeof body?.token === "string" ? body.token.trim() : "";
+  if (!isValidBuiltinAccessToken(token)) {
+    return NextResponse.json({ error: "Invalid access token" }, { status: 403 });
+  }
+
+  const response = NextResponse.json({ ok: true });
+  response.cookies.set(
+    BUILTIN_REMOTE_SESSION_COOKIE,
+    await createBuiltinRemoteSessionValue(),
+    getBuiltinRemoteSessionCookieOptions(request.nextUrl.protocol === "https:"),
+  );
+  return response;
+}
+
+export async function DELETE(request: NextRequest): Promise<NextResponse> {
+  const response = NextResponse.json({ ok: true });
+  clearSession(response);
+
+  if (!isBuiltinRemoteAuthEnabled()) {
+    return response;
+  }
+
+  response.cookies.set(BUILTIN_REMOTE_SESSION_COOKIE, "", {
+    ...getBuiltinRemoteSessionCookieOptions(request.nextUrl.protocol === "https:"),
+    maxAge: 0,
+  });
+  return response;
+}