conductor-oss 0.2.20 → 0.3.1

package/web/.next/standalone/packages/web/src/app/api/context-files/route.ts

@@ -1,201 +1,5 @@
-import { NextResponse } from "next/server";
-import { existsSync, type Dirent } from "node:fs";
-import { readdir, stat } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, join, resolve, sep } from "node:path";
-import type { OrchestratorConfig } from "@conductor-oss/core";
-import { guardApiAccess } from "@/lib/auth";
-import { getServices } from "@/lib/services";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-const MAX_FILES = 300;
-const MAX_DEPTH = 4;
-
-const IMAGE_EXTENSIONS = new Set([
-  ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp", ".ico", ".tiff",
-]);
-
-const CONTEXT_EXTENSIONS = new Set([
-  ".md", ".mdx", ".txt", ".rtf", ".csv", ".tsv",
-  ".json", ".jsonl", ".yaml", ".yml", ".toml", ".ini",
-  ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py", ".rb", ".go", ".rs",
-  ".java", ".kt", ".swift", ".c", ".cc", ".cpp", ".h", ".hpp",
-  ".css", ".scss", ".html", ".sql", ".sh", ".bash", ".zsh",
-  ".pdf",
-  ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp", ".ico", ".tiff",
-]);
-
-function asNonEmptyString(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-
-function expandHome(value: string): string {
-  if (value.startsWith("~/")) {
-    return resolve(homedir(), value.slice(2));
-  }
-  return resolve(value);
-}
-
-function resolveWorkspacePath(config: OrchestratorConfig): string {
-  if (process.env["CONDUCTOR_WORKSPACE"]?.trim()) {
-    return expandHome(process.env["CONDUCTOR_WORKSPACE"]);
-  }
-  if (config.configPath) {
-    return dirname(config.configPath);
-  }
-  return resolve(process.cwd());
-}
-
-function lastPathSegment(value: string): string {
-  const normalized = value.replaceAll("\\", "/");
-  const segments = normalized.split("/").filter(Boolean);
-  return segments[segments.length - 1] ?? "";
-}
-
-function extensionOf(path: string): string {
-  const index = path.lastIndexOf(".");
-  if (index < 0) return "";
-  return path.slice(index).toLowerCase();
-}
-
-function isAllowedContextFile(path: string): boolean {
-  const ext = extensionOf(path);
-  return CONTEXT_EXTENSIONS.has(ext);
-}
-
-function isImageFile(path: string): boolean {
-  const ext = extensionOf(path);
-  return IMAGE_EXTENSIONS.has(ext);
-}
-
-function toWorkspaceRelative(workspaceRoot: string, path: string): string | null {
-  const resolvedWorkspace = resolve(workspaceRoot);
-  const resolvedPath = resolve(path);
-  const workspacePrefix = resolvedWorkspace.endsWith(sep)
-    ? resolvedWorkspace
-    : `${resolvedWorkspace}${sep}`;
-  if (resolvedPath !== resolvedWorkspace && !resolvedPath.startsWith(workspacePrefix)) {
-    return null;
-  }
-  return resolvedPath.slice(resolvedWorkspace.length).replace(/^[/\\]+/, "").replaceAll("\\", "/");
-}
-
-type ContextFileEntry = {
-  path: string;
-  name: string;
-  kind: "image" | "file";
-  source: string;
-  sizeBytes: number | null;
-};
-
-async function collectContextFiles(params: {
-  workspaceRoot: string;
-  rootPath: string;
-  source: string;
-  seen: Set<string>;
-  files: ContextFileEntry[];
-}): Promise<void> {
-  if (!existsSync(params.rootPath)) return;
-  const queue: Array<{ dir: string; depth: number }> = [{ dir: params.rootPath, depth: 0 }];
-
-  while (queue.length > 0 && params.files.length < MAX_FILES) {
-    const current = queue.shift();
-    if (!current) break;
-
-    let entries: Dirent[];
-    try {
-      entries = await readdir(current.dir, { withFileTypes: true, encoding: "utf8" }) as Dirent[];
-    } catch {
-      continue;
-    }
-
-    entries.sort((a, b) => String(a.name).localeCompare(String(b.name)));
-    for (const entry of entries) {
-      if (params.files.length >= MAX_FILES) break;
-      const entryName = String(entry.name);
-      if (entryName.startsWith(".")) continue;
-      const fullPath = join(current.dir, entryName);
-
-      if (entry.isDirectory()) {
-        if (current.depth < MAX_DEPTH) {
-          queue.push({ dir: fullPath, depth: current.depth + 1 });
-        }
-        continue;
-      }
-
-      if (!entry.isFile()) continue;
-      const relativePath = toWorkspaceRelative(params.workspaceRoot, fullPath);
-      if (!relativePath) continue;
-      if (!isAllowedContextFile(relativePath)) continue;
-      if (params.seen.has(relativePath)) continue;
-
-      params.seen.add(relativePath);
-      const fileStat = await stat(fullPath).catch(() => null);
-      params.files.push({
-        path: relativePath,
-        name: entryName,
-        kind: isImageFile(relativePath) ? "image" : "file",
-        source: params.source,
-        sizeBytes: fileStat?.size ?? null,
-      });
-    }
-  }
-}
-
-/** GET /api/context-files?projectId=<id> -- List likely context/attachment files for task composer. */
-export async function GET(request: Request) {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-
-  try {
-    const { config } = await getServices();
-    const workspaceRoot = resolveWorkspacePath(config);
-    const url = new URL(request.url);
-    const projectId = asNonEmptyString(url.searchParams.get("projectId"));
-
-    if (projectId && !config.projects[projectId]) {
-      return NextResponse.json({ error: `Unknown project: ${projectId}` }, { status: 404 });
-    }
-
-    const roots: Array<{ path: string; source: string }> = [
-      { path: resolve(workspaceRoot, "attachments"), source: "workspace/attachments" },
-      { path: resolve(workspaceRoot, "context"), source: "workspace/context" },
-    ];
-
-    if (projectId) {
-      const project = config.projects[projectId];
-      const boardDir = lastPathSegment(project.boardDir ?? projectId) || projectId;
-      roots.push({ path: resolve(workspaceRoot, "projects", boardDir, "attachments"), source: `projects/${boardDir}/attachments` });
-      roots.push({ path: resolve(workspaceRoot, "projects", boardDir, "context"), source: `projects/${boardDir}/context` });
-      roots.push({ path: resolve(workspaceRoot, boardDir, "attachments"), source: `${boardDir}/attachments` });
-      roots.push({ path: resolve(workspaceRoot, boardDir, "context"), source: `${boardDir}/context` });
-    }
-
-    const files: ContextFileEntry[] = [];
-    const seen = new Set<string>();
-
-    for (const root of roots) {
-      await collectContextFiles({
-        workspaceRoot,
-        rootPath: root.path,
-        source: root.source,
-        seen,
-        files,
-      });
-      if (files.length >= MAX_FILES) break;
-    }
-
-    return NextResponse.json({
-      workspacePath: workspaceRoot,
-      files,
-    });
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to list context files" },
-      { status: 500 },
-    );
-  }
-}
+export const GET = guardedProxyRoute("/api/context-files", { role: "viewer" });

package/web/.next/standalone/packages/web/src/app/api/events/route.ts

@@ -1,125 +1,5 @@
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
-import { sessionToDashboard } from "@/lib/serialize";
-import { getAttentionLevel } from "@/lib/types";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-/**
- * GET /api/events -- SSE stream for real-time session updates.
- *
- * Polls SessionManager.list() every 5 seconds, sends compact snapshots.
- * Heartbeat every 15 seconds to keep the connection alive.
- *
- * Fixes applied:
- *   - Respects request.signal for abort handling (prevents interval leaks)
- *   - inFlight guard prevents overlapping poll promises
- *   - Closed flag prevents enqueue-after-close errors
- */
-export async function GET(request: Request): Promise<Response> {
-  const denied = await guardApiAccess(request, "viewer");
-  if (denied) return denied;
-
-  const encoder = new TextEncoder();
-  let heartbeat: ReturnType<typeof setInterval> | undefined;
-  let updates: ReturnType<typeof setInterval> | undefined;
-  let closed = false;
-  let inFlight = false;
-
-  function cleanup(): void {
-    closed = true;
-    clearInterval(heartbeat);
-    clearInterval(updates);
-  }
-
-  function safeSend(controller: ReadableStreamDefaultController, chunk: string): boolean {
-    if (closed) return false;
-    try {
-      controller.enqueue(encoder.encode(chunk));
-      return true;
-    } catch {
-      cleanup();
-      return false;
-    }
-  }
-
-  function buildSnapshotPayload(sessions: ReturnType<typeof sessionToDashboard>[]): string {
-    const event = {
-      type: "snapshot",
-      sessions: sessions.map((s) => ({
-        id: s.id,
-        status: s.status,
-        activity: s.activity,
-        attentionLevel: getAttentionLevel(s),
-        projectId: s.projectId,
-        issueId: s.issueId,
-        branch: s.branch,
-        createdAt: s.createdAt,
-        lastActivityAt: s.lastActivityAt,
-        metadata: s.metadata,
-        summary: s.summary,
-        pr: s.pr,
-      })),
-    };
-    return `data: ${JSON.stringify(event)}\n\n`;
-  }
-
-  const stream = new ReadableStream({
-    start(controller) {
-      // Abort when client disconnects
-      request.signal.addEventListener("abort", () => {
-        cleanup();
-        try { controller.close(); } catch { /* already closed */ }
-      });
-
-      // Send initial snapshot
-      void (async () => {
-        try {
-          const { sessionManager } = await getServices();
-          const sessions = await sessionManager.list();
-          const dashboardSessions = sessions.map(sessionToDashboard);
-          safeSend(controller, buildSnapshotPayload(dashboardSessions));
-        } catch {
-          safeSend(controller, `data: ${JSON.stringify({ type: "snapshot", sessions: [] })}\n\n`);
-        }
-      })();
-
-      // Heartbeat every 15s
-      heartbeat = setInterval(() => {
-        if (!safeSend(controller, `: heartbeat\n\n`)) {
-          cleanup();
-        }
-      }, 15_000);
-
-      // Poll for state changes every 5s (with inFlight guard)
-      updates = setInterval(() => {
-        if (closed || inFlight) return;
-        inFlight = true;
-        void (async () => {
-          try {
-            const { sessionManager } = await getServices();
-            const sessions = await sessionManager.list();
-            const dashboardSessions = sessions.map(sessionToDashboard);
-            safeSend(controller, buildSnapshotPayload(dashboardSessions));
-          } catch {
-            // Skip this poll, retry next interval
-          } finally {
-            inFlight = false;
-          }
-        })();
-      }, 3_000);
-    },
-    cancel() {
-      cleanup();
-    },
-  });
-
-  return new Response(stream, {
-    headers: {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache",
-      Connection: "keep-alive",
-      "X-Accel-Buffering": "no",
-    },
-  });
-}
+export const GET = guardedProxyRoute("/api/events", { role: "viewer" });

package/web/.next/standalone/packages/web/src/app/api/executor/health/route.ts

@@ -0,0 +1,5 @@
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const GET = guardedProxyRoute("/api/executor/health", { role: "viewer" });

package/web/.next/standalone/packages/web/src/app/api/filesystem/directory/route.ts

@@ -1,145 +1,5 @@
-import { NextRequest, NextResponse } from "next/server";
-import { readdir, realpath, stat } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute, relative, resolve } from "node:path";
-import { guardApiAccess } from "@/lib/auth";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-const HOME_ROOT = homedir();
-const VOLUMES_ROOT = "/Volumes";
-const SAFE_SEGMENT_PATTERN = /^[^/\\\0\r\n]+$/;
-
-type DirectoryEntry = {
-  name: string;
-  path: string;
-  isDirectory: boolean;
-  isGitRepo: boolean;
-};
-
-class InputError extends Error {}
-
-function ensureWithinRoot(root: string, candidatePath: string) {
-  const rel = relative(root, candidatePath);
-  if (rel !== "" && (rel.startsWith("..") || isAbsolute(rel))) {
-    throw new InputError("Path is outside the allowed browse roots");
-  }
-}
-
-function resolveRootSelection(rawPath: string | null): { root: string; relativePath: string } {
-  if (!rawPath || rawPath.trim().length === 0) {
-    return { root: HOME_ROOT, relativePath: "" };
-  }
-
-  const trimmed = rawPath.trim();
-  if (/[\0\r\n]/.test(trimmed)) {
-    throw new InputError("Invalid path");
-  }
-
-  if (trimmed === "~" || trimmed === HOME_ROOT) {
-    return { root: HOME_ROOT, relativePath: "" };
-  }
-
-  if (trimmed.startsWith("~/")) {
-    return { root: HOME_ROOT, relativePath: trimmed.slice(2) };
-  }
-
-  if (trimmed.startsWith(`${HOME_ROOT}/`)) {
-    return { root: HOME_ROOT, relativePath: trimmed.slice(HOME_ROOT.length + 1) };
-  }
-
-  if (trimmed === VOLUMES_ROOT) {
-    return { root: VOLUMES_ROOT, relativePath: "" };
-  }
-
-  if (trimmed.startsWith(`${VOLUMES_ROOT}/`)) {
-    return { root: VOLUMES_ROOT, relativePath: trimmed.slice(VOLUMES_ROOT.length + 1) };
-  }
-
-  throw new InputError("Path is outside the allowed browse roots");
-}
-
-function parseSafeSegments(relativePath: string): string[] {
-  return relativePath
-    .split("/")
-    .filter(Boolean)
-    .map((segment) => {
-      if (!SAFE_SEGMENT_PATTERN.test(segment) || segment === "." || segment === "..") {
-        throw new InputError("Invalid path segment");
-      }
-      return segment;
-    });
-}
-
-async function resolveRequestedPath(rawPath: string | null): Promise<string> {
-  const { root, relativePath } = resolveRootSelection(rawPath);
-  const canonicalRoot = await realpath(root);
-  const segments = parseSafeSegments(relativePath);
-
-  let currentPath = canonicalRoot;
-
-  for (const segment of segments) {
-    const candidatePath = resolve(currentPath, segment);
-    const candidateStat = await stat(candidatePath);
-    if (!candidateStat.isDirectory()) {
-      throw new InputError("Path must be a directory");
-    }
-
-    const canonicalCandidate = await realpath(candidatePath);
-    ensureWithinRoot(canonicalRoot, canonicalCandidate);
-    currentPath = canonicalCandidate;
-  }
-
-  return currentPath;
-}
-
-async function isGitRepo(path: string): Promise<boolean> {
-  try {
-    const gitStat = await stat(resolve(path, ".git"));
-    return gitStat.isDirectory();
-  } catch {
-    return false;
-  }
-}
-
-export async function GET(request: NextRequest) {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-
-  const rawPath = request.nextUrl.searchParams.get("path");
-
-  try {
-    const currentPath = await resolveRequestedPath(rawPath);
-    const dirEntries = await readdir(currentPath, { withFileTypes: true });
-
-    const entries = await Promise.all(
-      dirEntries
-        .filter((entry) => entry.isDirectory() && !entry.name.startsWith("."))
-        .map(async (entry): Promise<DirectoryEntry> => {
-          const entryPath = resolve(currentPath, entry.name);
-          return {
-            name: entry.name,
-            path: entryPath,
-            isDirectory: true,
-            isGitRepo: await isGitRepo(entryPath),
-          };
-        }),
-    );
-
-    entries.sort((left, right) => {
-      if (left.isDirectory !== right.isDirectory) {
-        return left.isDirectory ? -1 : 1;
-      }
-      return left.name.localeCompare(right.name);
-    });
-
-    return NextResponse.json({
-      currentPath,
-      entries,
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to list directory";
-    const status = err instanceof InputError ? 400 : 500;
-    return NextResponse.json({ error: message }, { status });
-  }
-}
+export const GET = guardedProxyRoute("/api/filesystem/directory", { role: "operator" });

package/web/.next/standalone/packages/web/src/app/api/filesystem/pick-directory/route.ts

@@ -0,0 +1,5 @@
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const POST = guardedProxyRoute("/api/filesystem/pick-directory", { role: "operator" });

package/web/.next/standalone/packages/web/src/app/api/github/repos/route.ts

@@ -1,106 +1,5 @@
-import { NextRequest, NextResponse } from "next/server";
-import { promisify } from "node:util";
-import { execFile } from "node:child_process";
-import { guardApiAccess } from "@/lib/auth";
-
-const execFileAsync = promisify(execFile);
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-type GitHubRepo = {
-  name: string;
-  fullName: string;
-  httpsUrl: string;
-  sshUrl: string;
-  defaultBranch: string;
-  private: boolean;
-};
-
-type GhRepoListItem = {
-  nameWithOwner?: string;
-  url?: string;
-  sshUrl?: string;
-  isPrivate?: boolean;
-  defaultBranchRef?: {
-    name?: string;
-  } | null;
-};
-
-async function assertGhAuthenticated(): Promise<void> {
-  try {
-    await execFileAsync("gh", ["auth", "status"], {
-      timeout: 20_000,
-      env: {
-        ...process.env,
-        GH_PAGER: "cat",
-      },
-    });
-  } catch (err) {
-    if (typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT") {
-      throw new Error("GitHub CLI is not installed. Install `gh` and run `gh auth login`.");
-    }
-    throw new Error("GitHub CLI is not authenticated. Run `gh auth login` first.");
-  }
-}
-
-export async function GET(request: NextRequest) {
-  const denied = await guardApiAccess(undefined, "operator");
-  if (denied) return denied;
-
-  const query = request.nextUrl.searchParams.get("q")?.trim().toLowerCase() ?? "";
-
-  try {
-    await assertGhAuthenticated();
-
-    const { stdout } = await execFileAsync(
-      "gh",
-      [
-        "repo",
-        "list",
-        "--limit",
-        "200",
-        "--json",
-        "nameWithOwner,url,sshUrl,isPrivate,defaultBranchRef",
-      ],
-      {
-        timeout: 30_000,
-        env: {
-          ...process.env,
-          GH_PAGER: "cat",
-        },
-      },
-    );
-
-    const parsed = JSON.parse(stdout) as GhRepoListItem[];
-    let repos: GitHubRepo[] = parsed
-      .filter((item) => !!item.nameWithOwner)
-      .map((item) => {
-        const fullName = item.nameWithOwner ?? "";
-        const name = fullName.split("/").pop() ?? fullName;
-        const httpsUrl = item.url ? `${item.url}.git` : `https://github.com/${fullName}.git`;
-        return {
-          name,
-          fullName,
-          httpsUrl,
-          sshUrl: item.sshUrl ?? `git@github.com:${fullName}.git`,
-          defaultBranch: item.defaultBranchRef?.name ?? "main",
-          private: item.isPrivate === true,
-        };
-      });
-
-    if (query.length > 0) {
-      repos = repos.filter((repo) => {
-        return repo.fullName.toLowerCase().includes(query)
-          || repo.name.toLowerCase().includes(query)
-          || repo.defaultBranch.toLowerCase().includes(query);
-      });
-    }
-
-    repos.sort((left, right) => left.fullName.localeCompare(right.fullName));
-
-    return NextResponse.json({ repos });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to list GitHub repositories";
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}
+export const GET = guardedProxyRoute("/api/github/repos", { role: "operator" });

package/web/.next/standalone/packages/web/src/app/api/health/boards/route.ts

@@ -1,72 +1,5 @@
-import { readFileSync, existsSync } from "node:fs";
-import { NextResponse } from "next/server";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-/** GET /api/health/boards -- watcher board parse/health snapshot. */
-export async function GET() {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-
-  try {
-    const { config } = await getServices();
-    const coreModule = await import("@conductor-oss/core");
-    const core = coreModule as Record<string, unknown>;
-    const discoverBoards = core["discoverBoards"] as
-      | ((workspacePath: string, boardPathsOrConfig?: unknown) => string[])
-      | undefined;
-    const resolveBoardAliasesForPath = core["resolveBoardAliasesForPath"] as
-      | ((cfg: unknown, workspacePath: string, boardPath: string) => Record<string, string[]>)
-      | undefined;
-    const parseBoardStatus = core["parseBoardStatus"] as
-      | ((boardPath: string, content: string, aliases: Record<string, string[]>, projectIds: Set<string>) => Record<string, unknown>)
-      | undefined;
-    const readRecentWatcherActions = core["readRecentWatcherActions"] as
-      | ((workspacePath: string, limit?: number) => unknown[])
-      | undefined;
-    const defaultAliasMapping = core["defaultAliasMapping"] as (() => Record<string, string[]>) | undefined;
-    if (!discoverBoards || !parseBoardStatus || !readRecentWatcherActions) {
-      throw new Error("Core diagnostics helpers are unavailable. Run pnpm build.");
-    }
-    const workspace =
-      process.env["CONDUCTOR_WORKSPACE"] ?? `${process.env["HOME"]}/.conductor/workspace`;
-
-    const boardPatternsOrConfig = config.boards?.length ? config.boards : config;
-    const watchedBoards = discoverBoards(workspace, boardPatternsOrConfig);
-    const projectIds = new Set(Object.keys(config.projects));
-
-    const boards = watchedBoards.map((boardPath) => {
-      const aliases = resolveBoardAliasesForPath
-        ? resolveBoardAliasesForPath(config, workspace, boardPath)
-        : (defaultAliasMapping ? defaultAliasMapping() : {});
-      if (!existsSync(boardPath)) {
-        return {
-          boardPath,
-          exists: false,
-          parseOk: false,
-          errors: ["Board file does not exist"],
-          aliases,
-        };
-      }
-      const content = readFileSync(boardPath, "utf-8");
-      const status = parseBoardStatus(boardPath, content, aliases, projectIds);
-      return { ...status, aliases };
-    });
-
-    const recentActions = readRecentWatcherActions(workspace, 20);
-
-    return NextResponse.json({
-      workspace,
-      watchedBoards,
-      boards,
-      recentActions,
-    });
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to build board health" },
-      { status: 500 },
-    );
-  }
-}
+export const GET = guardedProxyRoute("/api/health/boards", { role: "viewer" });