conductor-oss 0.2.20 → 0.3.0

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/output/stream/route.ts

@@ -1,111 +1,8 @@
-import type { NextRequest } from "next/server";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-function parseLines(raw: string | null): number {
-  const parsed = raw ? Number.parseInt(raw, 10) : 500;
-  if (!Number.isFinite(parsed) || parsed <= 0) return 500;
-  return Math.min(parsed, 5000);
-}
-
-export async function GET(
-  request: NextRequest,
-  context: { params: Promise<{ id: string }> },
-): Promise<Response> {
-  const denied = await guardApiAccess(request, "viewer");
-  if (denied) return denied;
-
-  const params = await context.params;
-  const rawId = params?.id ?? "";
-  let sessionId: string;
-  try {
-    sessionId = decodeURIComponent(rawId).trim();
-  } catch {
-    return new Response("Invalid session id", { status: 400 });
-  }
-  if (!sessionId) return new Response("Session id is required", { status: 400 });
-
-  const lines = parseLines(new URL(request.url).searchParams.get("lines"));
-
-  const encoder = new TextEncoder();
-  let heartbeat: ReturnType<typeof setInterval> | undefined;
-  let updates: ReturnType<typeof setInterval> | undefined;
-  let inFlight = false;
-  let closed = false;
-  let lastOutput = "";
-
-  function cleanup(): void {
-    closed = true;
-    if (heartbeat) clearInterval(heartbeat);
-    if (updates) clearInterval(updates);
-  }
-
-  function safeSend(controller: ReadableStreamDefaultController, chunk: string): boolean {
-    if (closed) return false;
-    try {
-      controller.enqueue(encoder.encode(chunk));
-      return true;
-    } catch {
-      cleanup();
-      return false;
-    }
-  }
-
-  async function sendOutput(
-    controller: ReadableStreamDefaultController,
-    force = false,
-  ): Promise<void> {
-    try {
-      const { sessionManager } = await getServices();
-      const output = await sessionManager.getOutput(sessionId, lines);
-      if (force || output !== lastOutput) {
-        lastOutput = output;
-        safeSend(controller, `data: ${JSON.stringify({ type: "output", output })}\n\n`);
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : "Failed to stream output";
-      safeSend(controller, `data: ${JSON.stringify({ type: "error", error: message })}\n\n`);
-    }
-  }
-
-  const stream = new ReadableStream({
-    start(controller) {
-      request.signal.addEventListener("abort", () => {
-        cleanup();
-        try {
-          controller.close();
-        } catch {
-          // Ignore already-closed stream errors.
-        }
-      });
-
-      void sendOutput(controller, true);
-
-      heartbeat = setInterval(() => {
-        if (!safeSend(controller, ": heartbeat\n\n")) cleanup();
-      }, 15_000);
-
-      updates = setInterval(() => {
-        if (closed || inFlight) return;
-        inFlight = true;
-        void sendOutput(controller).finally(() => {
-          inFlight = false;
-        });
-      }, 1000);
-    },
-    cancel() {
-      cleanup();
-    },
-  });
-
-  return new Response(stream, {
-    headers: {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache",
-      Connection: "keep-alive",
-      "X-Accel-Buffering": "no",
-    },
-  });
-}
+export const GET = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/output/stream`,
+  { role: "viewer" },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/restore/route.ts

@@ -1,49 +1,8 @@
-import type { NextRequest } from "next/server";
-import { NextResponse } from "next/server";
-import { SessionNotRestorableError, WorkspaceMissingError } from "@conductor-oss/core/types";
-import { getServices } from "@/lib/services";
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(
-  request: NextRequest,
-  context: { params: Promise<{ id: string }> },
-) {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  const params = await context.params;
-  const rawId = params?.id ?? "";
-  let sessionId: string;
-  try {
-    sessionId = decodeURIComponent(rawId).trim();
-  } catch {
-    return NextResponse.json({ error: "Invalid session id" }, { status: 400 });
-  }
-  if (!sessionId) {
-    return NextResponse.json({ error: "Session id is required" }, { status: 400 });
-  }
-
-  try {
-    const { sessionManager } = await getServices();
-    const session = await sessionManager.restore(sessionId);
-    return NextResponse.json({ ok: true, sessionId: session.id });
-  } catch (err) {
-    if (err instanceof Error && /not found/i.test(err.message)) {
-      return NextResponse.json({ error: err.message }, { status: 404 });
-    }
-    if (err instanceof SessionNotRestorableError || err instanceof WorkspaceMissingError) {
-      return NextResponse.json(
-        { error: err.message },
-        { status: 409 },
-      );
-    }
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to restore session" },
-      { status: 500 },
-    );
-  }
-}
+export const POST = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/restore`,
+  { role: "operator", requireActionGuard: true },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/route.ts

@@ -1,206 +1,8 @@
-import { type NextRequest, NextResponse } from "next/server";
-import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
-import { sessionToDashboard, normalizeSummary } from "@/lib/serialize";
-import type { DashboardSession } from "@/lib/types";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
-const VALID_SESSION_ID = /^[a-zA-Z0-9_-]+$/;
+export const dynamic = "force-dynamic";
 
-/** Parse key=value metadata file. */
-function parseMetadata(content: string): Record<string, string> {
-  const result: Record<string, string> = {};
-  for (const line of content.split("\n")) {
-    const idx = line.indexOf("=");
-    if (idx > 0) {
-      result[line.slice(0, idx)] = line.slice(idx + 1);
-    }
-  }
-  return result;
-}
-
-function readMetadataFile(filePath: string): Record<string, string> | null {
-  try {
-    return parseMetadata(readFileSync(filePath, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-
-function safeSessionDirs(projectDir: string): string[] {
-  try {
-    return readdirSync(projectDir);
-  } catch {
-    return [];
-  }
-}
-
-function buildArchivedSummary(meta: Record<string, string>): string | null {
-  const existing = normalizeSummary(meta["summary"]);
-  if (existing) return existing;
-  if (!meta["pr"]) return null;
-
-  const prNumber = parseInt(meta["pr"].match(/\/(\d+)$/)?.[1] ?? "0", 10);
-  const prTitle = meta["prTitle"] ?? "";
-  const prState = meta["prState"] ?? "open";
-  const ciStatus = meta["ciStatus"] ?? "none";
-  const reviewDecision = meta["reviewDecision"] ?? "none";
-  return `PR #${Number.isFinite(prNumber) && prNumber > 0 ? prNumber : "?"}${prTitle ? ` — ${prTitle}` : ""} · state: ${prState} · CI: ${ciStatus} · review: ${reviewDecision}`;
-}
-
-function parsePRFromMeta(meta: Record<string, string>): DashboardSession["pr"] {
-  const prUrl = meta["pr"];
-  if (!prUrl) return null;
-
-  const num = parseInt(prUrl.match(/\/(\d+)$/)?.[1] ?? "0", 10);
-  let mergeability: NonNullable<DashboardSession["pr"]>["mergeability"] = {
-    mergeable: false,
-    ciPassing: false,
-    approved: false,
-    noConflicts: true,
-    blockers: [],
-  };
-
-  if (meta["mergeReadiness"]) {
-    try {
-      const parsed = JSON.parse(meta["mergeReadiness"]) as Record<string, unknown>;
-      mergeability = {
-        mergeable: Boolean(parsed["mergeable"]),
-        ciPassing: Boolean(parsed["ciPassing"]),
-        approved: Boolean(parsed["approved"]),
-        noConflicts: parsed["noConflicts"] !== false,
-        blockers: Array.isArray(parsed["blockers"]) ? (parsed["blockers"] as string[]) : [],
-      };
-    } catch {
-      // ignore malformed JSON
-    }
-  }
-
-  return {
-    number: Number.isFinite(num) && num > 0 ? num : 0,
-    url: prUrl,
-    title: meta["prTitle"] ?? "",
-    branch: meta["prHeadRef"] ?? meta["branch"] ?? "",
-    baseBranch: meta["prBaseRef"] ?? "",
-    isDraft: meta["prDraft"] === "1" || meta["prDraft"] === "true",
-    state: (meta["prState"] as NonNullable<DashboardSession["pr"]>["state"]) || "open",
-    ciStatus: (meta["ciStatus"] as NonNullable<DashboardSession["pr"]>["ciStatus"]) || "none",
-    reviewDecision: (meta["reviewDecision"] as NonNullable<DashboardSession["pr"]>["reviewDecision"]) || "none",
-    mergeability,
-    previewUrl: meta["previewUrl"] ?? null,
-  };
-}
-
-/** Build a DashboardSession from raw metadata (for archived sessions). */
-function metadataToDashboard(id: string, meta: Record<string, string>, filePath: string): DashboardSession {
-  const createdAt = meta["createdAt"] ?? new Date().toISOString();
-  let lastActivityAt = createdAt;
-  try {
-    const st = statSync(filePath);
-    lastActivityAt = st.mtime.toISOString();
-  } catch {
-    /* ignore */
-  }
-
-  return {
-    id,
-    projectId: meta["project"] ?? "unknown",
-    status: (meta["status"] ?? "unknown") as DashboardSession["status"],
-    activity: null,
-    branch: meta["branch"] ?? null,
-    issueId: null,
-    summary: buildArchivedSummary(meta),
-    createdAt,
-    lastActivityAt,
-    pr: parsePRFromMeta(meta),
-    metadata: meta,
-  };
-}
-
-/** Find session by scanning ~/.conductor directories (active + archive). */
-function findSessionDirect(sessionId: string): DashboardSession | null {
-  const conductorDir = join(homedir(), ".conductor");
-  if (!existsSync(conductorDir)) return null;
-
-  const projectDirs = safeSessionDirs(conductorDir);
-  for (const projectDir of projectDirs) {
-    const sessionsDir = join(conductorDir, projectDir, "sessions");
-    if (!existsSync(sessionsDir)) continue;
-
-    let sessionStat: { isDirectory: () => boolean } | null = null;
-    try {
-      sessionStat = statSync(sessionsDir);
-    } catch {
-      continue;
-    }
-    if (!sessionStat?.isDirectory()) continue;
-
-    // Active session
-    const activeFile = join(sessionsDir, sessionId);
-    if (existsSync(activeFile)) {
-      const meta = readMetadataFile(activeFile);
-      if (meta) {
-        return metadataToDashboard(sessionId, meta, activeFile);
-      }
-    }
-
-    // Archived session
-    const archiveDir = join(sessionsDir, "archive");
-    if (!existsSync(archiveDir)) continue;
-
-    const archiveFiles = safeSessionDirs(archiveDir)
-      .filter((f) => f.startsWith(sessionId + "_"))
-      .sort()
-      .reverse();
-
-    if (archiveFiles.length > 0) {
-      const filePath = join(archiveDir, archiveFiles[0]!);
-      const meta = readMetadataFile(filePath);
-      if (meta) {
-        return metadataToDashboard(sessionId, meta, filePath);
-      }
-    }
-  }
-
-  return null;
-}
-
-/** GET /api/sessions/:id -- Get a single session. */
-export async function GET(
-  _request: NextRequest,
-  { params }: { params: Promise<{ id: string }> },
-) {
-  try {
-    const denied = await guardApiAccess(undefined, "viewer");
-    if (denied) return denied;
-    const { id } = await params;
-    const sessionId = id.trim();
-
-    if (!sessionId) {
-      return NextResponse.json({ error: "Session ID is required" }, { status: 400 });
-    }
-    if (!VALID_SESSION_ID.test(sessionId)) {
-      return NextResponse.json({ error: "Invalid session ID" }, { status: 400 });
-    }
-
-    // Try active sessions first via session manager
-    const { sessionManager } = await getServices();
-    const session = await sessionManager.get(sessionId);
-    if (session) {
-      return NextResponse.json(sessionToDashboard(session));
-    }
-
-    // Fallback: direct filesystem scan (finds archived sessions too)
-    const direct = findSessionDirect(sessionId);
-    if (direct) {
-      return NextResponse.json(direct);
-    }
-
-    return NextResponse.json({ error: "Session not found" }, { status: 404 });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "Failed to load session";
-    return NextResponse.json({ error: msg }, { status: 500 });
-  }
-}
+export const GET = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}`,
+  { role: "viewer" },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/send/route.ts

@@ -1,58 +1,8 @@
-import type { NextRequest } from "next/server";
-import { NextResponse } from "next/server";
-import { getServices } from "@/lib/services";
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-type SendBody = { message?: string };
-
-export async function POST(
-  request: NextRequest,
-  context: { params: Promise<{ id: string }> },
-) {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  const params = await context.params;
-  const rawId = params?.id ?? "";
-  let sessionId: string;
-  try {
-    sessionId = decodeURIComponent(rawId).trim();
-  } catch {
-    return NextResponse.json({ error: "Invalid session id" }, { status: 400 });
-  }
-  if (!sessionId) {
-    return NextResponse.json({ error: "Session id is required" }, { status: 400 });
-  }
-
-  const body = (await request.json().catch(() => null)) as SendBody | null;
-  if (typeof body?.message !== "string") {
-    return NextResponse.json(
-      { error: "message is required and must be non-empty" },
-      { status: 400 },
-    );
-  }
-
-  const messageStr = body.message;
-  const message = messageStr.trim();
-  if (!message) {
-    return NextResponse.json(
-      { error: "message is required and must be non-empty" },
-      { status: 400 },
-    );
-  }
-
-  try {
-    const { sessionManager } = await getServices();
-    await sessionManager.send(sessionId, message);
-    return NextResponse.json({ ok: true });
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to send message" },
-      { status: 500 },
-    );
-  }
-}
+export const POST = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/send`,
+  { role: "operator", requireActionGuard: true },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/route.ts

@@ -1,105 +1,5 @@
-import type { NextRequest } from "next/server";
-import { NextResponse } from "next/server";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
-import { computeStats, sessionToDashboard } from "@/lib/serialize";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-/**
- * GET /api/sessions -- list current sessions for the dashboard.
- *
- * Query params:
- *   - project: filter by project ID
- *   - filter: attention filter (needs_input, blocked, errored, active, all)
- *   - compact: "true" for mobile-optimized minimal response
- */
-export async function GET(request: NextRequest) {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-
-  try {
-    const { sessionManager } = await getServices();
-
-    const searchParams = new URL(request.url).searchParams;
-    const projectId = searchParams.get("project");
-    const filter = searchParams.get("filter");
-    const compact = searchParams.get("compact") === "true";
-    const normalizedProjectId = projectId?.trim() ?? "";
-
-    const sessions = normalizedProjectId
-      ? await sessionManager.list(normalizedProjectId)
-      : await sessionManager.list();
-    let dashboardSessions = sessions.map((session) => sessionToDashboard(session));
-
-    // Apply attention filter
-    if (filter) {
-      const needsAttentionStatuses = new Set(["needs_input", "stuck", "errored"]);
-      const needsAttentionActivities = new Set(["waiting_input", "blocked"]);
-
-      switch (filter) {
-        case "needs_input":
-        case "respond":
-          dashboardSessions = dashboardSessions.filter(
-            (s) => needsAttentionStatuses.has(s.status) || needsAttentionActivities.has(s.activity ?? ""),
-          );
-          break;
-        case "blocked":
-          dashboardSessions = dashboardSessions.filter(
-            (s) => s.activity === "blocked" || s.status === "stuck",
-          );
-          break;
-        case "errored":
-          dashboardSessions = dashboardSessions.filter(
-            (s) => s.status === "errored" || s.status === "ci_failed",
-          );
-          break;
-        case "active":
-        case "working":
-          dashboardSessions = dashboardSessions.filter(
-            (s) => s.activity === "active" || s.status === "working" || s.status === "spawning",
-          );
-          break;
-        case "review":
-          dashboardSessions = dashboardSessions.filter(
-            (s) => s.status === "ci_failed" || s.status === "changes_requested" || s.status === "review_pending",
-          );
-          break;
-        case "merge":
-          dashboardSessions = dashboardSessions.filter(
-            (s) => s.status === "mergeable" || s.status === "approved",
-          );
-          break;
-        // "all" or unknown: no filter
-      }
-    }
-
-    // Compact mode: minimal response for mobile
-    if (compact) {
-      const compactSessions = dashboardSessions.map((s) => ({
-        id: s.id,
-        p: s.projectId,
-        s: s.status,
-        a: s.activity,
-        sum: s.summary ? s.summary.slice(0, 80) : null,
-        pr: s.pr ? { n: s.pr.number, u: s.pr.url, ci: s.pr.ciStatus } : null,
-        age: s.createdAt,
-        idle: s.lastActivityAt,
-      }));
-      return NextResponse.json({
-        sessions: compactSessions,
-        stats: computeStats(dashboardSessions),
-      });
-    }
-
-    return NextResponse.json({
-      sessions: dashboardSessions,
-      stats: computeStats(dashboardSessions),
-    });
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to list sessions" },
-      { status: 500 },
-    );
-  }
-}
+export const GET = guardedProxyRoute("/api/sessions", { role: "viewer" });