conductor-oss 0.2.20 → 0.3.1

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/files/route.ts

@@ -1,197 +1,8 @@
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { resolve, sep } from "node:path";
-import type { NextRequest } from "next/server";
-import { NextResponse } from "next/server";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-const MAX_FILE_COUNT = 4000;
-const MAX_FILE_SIZE_BYTES = 1024 * 1024;
-const BINARY_SAMPLE_BYTES = 8000;
-const IGNORE_DIRS = new Set([
-  ".git",
-  ".next",
-  ".turbo",
-  "node_modules",
-  "dist",
-  "build",
-  "coverage",
-  "target",
-]);
-
-type FileListResponse = {
-  workspacePath: string;
-  files: string[];
-  truncated: boolean;
-};
-
-type FileContentResponse = {
-  workspacePath: string;
-  path: string;
-  content: string | null;
-  size: number;
-  binary: boolean;
-  truncated: boolean;
-};
-
-function sanitizeSessionId(raw: string): string {
-  try {
-    return decodeURIComponent(raw).trim();
-  } catch {
-    return "";
-  }
-}
-
-function isDir(path: string): boolean {
-  try {
-    return statSync(path).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
-function isFile(path: string): boolean {
-  try {
-    return statSync(path).isFile();
-  } catch {
-    return false;
-  }
-}
-
-function listWorkspaceFiles(root: string): FileListResponse {
-  const files: string[] = [];
-  let truncated = false;
-  const stack = [root];
-
-  while (stack.length > 0) {
-    const current = stack.pop();
-    if (!current) break;
-
-    let entries: string[] = [];
-    try {
-      entries = readdirSync(current);
-    } catch {
-      continue;
-    }
-
-    for (const entry of entries) {
-      if (entry === "." || entry === "..") continue;
-      if (entry === ".git") continue;
-      const absolute = resolve(current, entry);
-      const relative = absolute.slice(root.length + 1).split(sep).join("/");
-
-      if (isDir(absolute)) {
-        if (!IGNORE_DIRS.has(entry)) {
-          stack.push(absolute);
-        }
-        continue;
-      }
-
-      if (!isFile(absolute)) continue;
-      files.push(relative);
-      if (files.length >= MAX_FILE_COUNT) {
-        truncated = true;
-        return {
-          workspacePath: root,
-          files: files.sort((left, right) => left.localeCompare(right, undefined, { sensitivity: "base" })),
-          truncated,
-        };
-      }
-    }
-  }
-
-  return {
-    workspacePath: root,
-    files: files.sort((left, right) => left.localeCompare(right, undefined, { sensitivity: "base" })),
-    truncated,
-  };
-}
-
-function safeResolveFile(workspacePath: string, relativePath: string): string | null {
-  const cleaned = relativePath
-    .trim()
-    .replace(/\\/g, "/")
-    .replace(/^\/+/g, "")
-    .replace(/\/+/g, "/");
-  if (!cleaned || cleaned.startsWith("../") || cleaned.includes("/../")) return null;
-
-  const resolvedFile = resolve(workspacePath, cleaned);
-  const rootPrefix = workspacePath.endsWith(sep) ? workspacePath : `${workspacePath}${sep}`;
-  if (resolvedFile !== workspacePath && !resolvedFile.startsWith(rootPrefix)) {
-    return null;
-  }
-  return resolvedFile;
-}
-
-function loadFileContent(workspacePath: string, relativePath: string): FileContentResponse | null {
-  const resolvedFile = safeResolveFile(workspacePath, relativePath);
-  if (!resolvedFile || !existsSync(resolvedFile) || !isFile(resolvedFile)) return null;
-
-  let raw: Buffer;
-  try {
-    raw = readFileSync(resolvedFile);
-  } catch {
-    return null;
-  }
-
-  const size = raw.byteLength;
-  const sample = raw.subarray(0, Math.min(BINARY_SAMPLE_BYTES, raw.byteLength));
-  const binary = sample.includes(0);
-  const truncated = size > MAX_FILE_SIZE_BYTES;
-  const content = binary
-    ? null
-    : raw.subarray(0, Math.min(size, MAX_FILE_SIZE_BYTES)).toString("utf8");
-
-  return {
-    workspacePath,
-    path: relativePath,
-    content,
-    size,
-    binary,
-    truncated,
-  };
-}
-
-export async function GET(
-  request: NextRequest,
-  context: { params: Promise<unknown> },
-) {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-
-  const params = await context.params as { id?: unknown } | null;
-  const id = typeof params?.id === "string" ? params.id : "";
-  const sessionId = sanitizeSessionId(id);
-  if (!sessionId) {
-    return NextResponse.json({ error: "Session id is required" }, { status: 400 });
-  }
-
-  try {
-    const { sessionManager } = await getServices();
-    const session = await sessionManager.get(sessionId);
-    if (!session) {
-      return NextResponse.json({ error: `Session ${sessionId} not found` }, { status: 404 });
-    }
-
-    const workspacePath = session.workspacePath ?? session.metadata["worktree"];
-    if (!workspacePath || !isDir(workspacePath)) {
-      return NextResponse.json({ error: "Session workspace is unavailable" }, { status: 404 });
-    }
-
-    const requestedPath = request.nextUrl.searchParams.get("path");
-    if (requestedPath && requestedPath.trim().length > 0) {
-      const filePayload = loadFileContent(workspacePath, requestedPath);
-      if (!filePayload) {
-        return NextResponse.json({ error: "File not found" }, { status: 404 });
-      }
-      return NextResponse.json(filePayload);
-    }
-
-    return NextResponse.json(listWorkspaceFiles(workspacePath));
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load workspace files";
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}
+export const GET = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/files`,
+  { role: "viewer" },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/keys/route.ts

@@ -1,140 +1,8 @@
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
-import { type NextRequest, NextResponse } from "next/server";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
-const execFileAsync = promisify(execFile);
-const VALID_SESSION_ID = /^[a-zA-Z0-9_-]+$/;
+export const dynamic = "force-dynamic";
 
-/** Parse a simple key=value metadata file into a record. */
-function parseMetadata(content: string): Record<string, string> {
-  const result: Record<string, string> = {};
-  for (const line of content.split("\n")) {
-    const idx = line.indexOf("=");
-    if (idx > 0) {
-      result[line.slice(0, idx)] = line.slice(idx + 1);
-    }
-  }
-  return result;
-}
-
-function safeReadMetadata(filePath: string): Record<string, string> | null {
-  try {
-    return parseMetadata(readFileSync(filePath, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-
-function safeEntries(dir: string): string[] {
-  try {
-    return readdirSync(dir);
-  } catch {
-    return [];
-  }
-}
-
-/** Resolve tmux session name by scanning conductor metadata. */
-function resolveTmuxName(sessionId: string): string | null {
-  const conductorDir = join(homedir(), ".conductor");
-  if (!existsSync(conductorDir)) return null;
-
-  for (const projectDir of safeEntries(conductorDir)) {
-    const sessionsDir = join(conductorDir, projectDir, "sessions");
-    if (!existsSync(sessionsDir)) continue;
-    try {
-      if (!statSync(sessionsDir).isDirectory()) continue;
-    } catch {
-      continue;
-    }
-
-    const activeFile = join(sessionsDir, sessionId);
-    if (existsSync(activeFile)) {
-      const meta = safeReadMetadata(activeFile);
-      if (!meta) continue;
-      if (meta["tmuxName"]) return meta["tmuxName"];
-      if (meta["runtimeHandle"]) {
-        try {
-          const handle = JSON.parse(meta["runtimeHandle"]) as { id?: string };
-          if (handle.id) return handle.id;
-        } catch { /* ignore */ }
-      }
-    }
-  }
-
-  return null;
-}
-
-/** Allowed special key names for tmux send-keys. */
-const ALLOWED_SPECIAL_KEYS = new Set([
-  "Enter", "Escape", "Tab", "BSpace", "DC", "Up", "Down", "Left", "Right",
-  "Home", "End", "PageUp", "PageDown", "Space",
-  "C-c", "C-d", "C-u", "C-l", "C-a", "C-e", "C-k", "C-w", "C-z",
-]);
-
-/**
- * POST /api/sessions/:id/keys -- Send raw keys to the session's tmux pane.
- *
- * Body: { keys: string }
- *   - For text: sends literal characters via tmux send-keys -l
- *   - For special keys: use names like "Enter", "C-c", "Escape"
- *
- * Body: { special: string }
- *   - Sends a tmux special key (Enter, C-c, Escape, etc.)
- */
-export async function POST(
-  request: NextRequest,
-  { params }: { params: Promise<{ id: string }> },
-): Promise<NextResponse> {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  const { id } = await params;
-
-  if (!id || id.trim().length === 0) {
-    return NextResponse.json({ error: "Session ID is required" }, { status: 400 });
-  }
-  if (!VALID_SESSION_ID.test(id)) {
-    return NextResponse.json({ error: "Invalid session ID" }, { status: 400 });
-  }
-
-  const body = (await request.json().catch(() => null)) as Record<string, unknown> | null;
-  if (!body) {
-    return NextResponse.json({ error: "Request body required" }, { status: 400 });
-  }
-
-  const tmuxName = resolveTmuxName(id);
-  if (!tmuxName) {
-    return NextResponse.json({ error: "Session not found or no tmux session" }, { status: 404 });
-  }
-
-  try {
-    if (typeof body.special === "string") {
-      // Send a special key (Enter, C-c, Escape, etc.)
-      const key = body.special;
-      if (!ALLOWED_SPECIAL_KEYS.has(key)) {
-        return NextResponse.json({ error: `Invalid special key: ${key}` }, { status: 400 });
-      }
-      await execFileAsync("tmux", ["send-keys", "-t", tmuxName, key], { timeout: 5000 });
-    } else if (typeof body.keys === "string") {
-      // Send literal text characters
-      const keys = body.keys;
-      if (keys.length > 5000) {
-        return NextResponse.json({ error: "Keys too long (max 5000)" }, { status: 400 });
-      }
-      await execFileAsync("tmux", ["send-keys", "-t", tmuxName, "-l", keys], { timeout: 5000 });
-    } else {
-      return NextResponse.json({ error: "keys (string) or special (string) is required" }, { status: 400 });
-    }
-
-    return NextResponse.json({ ok: true, sessionId: id });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "Failed to send keys";
-    return NextResponse.json({ error: msg }, { status: 500 });
-  }
-}
+export const POST = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/keys`,
+  { role: "operator", requireActionGuard: true },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/kill/route.ts

@@ -1,45 +1,8 @@
-import type { NextRequest } from "next/server";
-import { NextResponse } from "next/server";
-import { getServices } from "@/lib/services";
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(
-  request: NextRequest,
-  context: { params: Promise<{ id: string }> },
-) {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  const params = await context.params;
-  const rawId = params?.id ?? "";
-  let sessionId: string;
-  try {
-    sessionId = decodeURIComponent(rawId).trim();
-  } catch (error) {
-    return NextResponse.json({ error: "Malformed session id" }, { status: 400 });
-  }
-  if (!sessionId) {
-    return NextResponse.json({ error: "Session id is required" }, { status: 400 });
-  }
-
-  try {
-    const { sessionManager } = await getServices();
-    await sessionManager.kill(sessionId);
-    return NextResponse.json({ ok: true });
-  } catch (err) {
-    if (
-      err instanceof Error &&
-      err.message.toLowerCase().includes("not found")
-    ) {
-      return NextResponse.json({ error: err instanceof Error ? err.message : "Session not found" }, { status: 404 });
-    }
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to kill session" },
-      { status: 500 },
-    );
-  }
-}
+export const POST = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/kill`,
+  { role: "operator", requireActionGuard: true },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/output/route.ts

@@ -1,262 +1,8 @@
-import type { NextRequest } from "next/server";
-import { NextResponse } from "next/server";
-import { existsSync, readdirSync, readFileSync, statSync, type Dirent } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { homedir } from "node:os";
-import { getServices } from "@/lib/services";
-import { guardApiAccess } from "@/lib/auth";
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-type SessionSnapshot = {
-  filePath: string;
-  values: Record<string, string>;
-};
-
-function parseMetadataFile(content: string): Record<string, string> {
-  const values: Record<string, string> = {};
-  for (const rawLine of content.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq <= 0) continue;
-    const key = line.slice(0, eq).trim();
-    const value = line.slice(eq + 1).trim();
-    if (key) values[key] = value;
-  }
-  return values;
-}
-
-function tailText(content: string, lines: number): string {
-  const chunks = content.split(/\r?\n/);
-  return chunks.slice(-Math.max(lines, 1)).join("\n").trimEnd();
-}
-
-function resolveHomePath(value: string): string {
-  if (value.startsWith("~/")) {
-    return resolve(homedir(), value.slice(2));
-  }
-  return resolve(value);
-}
-
-function isReadableFile(path: string): boolean {
-  try {
-    return statSync(path).isFile();
-  } catch {
-    return false;
-  }
-}
-
-function findSnapshotPaths(sessionId: string): string[] {
-  const conductorRoot = resolve(homedir(), ".conductor");
-  if (!existsSync(conductorRoot)) return [];
-
-  const candidates: string[] = [];
-  let roots: Dirent[];
-  try {
-    roots = readdirSync(conductorRoot, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-
-  for (const entry of roots) {
-    if (!entry.isDirectory()) continue;
-    const sessionsDir = join(conductorRoot, entry.name, "sessions");
-    if (!existsSync(sessionsDir)) continue;
-
-    const live = join(sessionsDir, sessionId);
-    if (isReadableFile(live)) {
-      candidates.push(live);
-    }
-
-    const archiveDir = join(sessionsDir, "archive");
-    if (!existsSync(archiveDir)) continue;
-    let archiveEntries: string[];
-    try {
-      archiveEntries = readdirSync(archiveDir);
-    } catch {
-      continue;
-    }
-
-    for (const fileName of archiveEntries) {
-      if (fileName === sessionId || fileName.startsWith(`${sessionId}_`)) {
-        const path = join(archiveDir, fileName);
-        if (isReadableFile(path)) {
-          candidates.push(path);
-        }
-      }
-    }
-  }
-
-  return candidates.sort((left, right) => {
-    try {
-      return statSync(right).mtimeMs - statSync(left).mtimeMs;
-    } catch {
-      return 0;
-    }
-  });
-}
-
-function readLatestSessionSnapshot(sessionId: string): SessionSnapshot | null {
-  for (const path of findSnapshotPaths(sessionId)) {
-    try {
-      const raw = readFileSync(path, "utf8");
-      const values = parseMetadataFile(raw);
-      return { filePath: path, values };
-    } catch {
-      continue;
-    }
-  }
-  return null;
-}
-
-function buildFallbackLogCandidates(sessionId: string, snapshot: SessionSnapshot): string[] {
-  const values = snapshot.values;
-  const tmuxName = values["tmuxName"]?.trim();
-  const worktree = values["worktree"]?.trim();
-
-  const paths = new Set<string>();
-  const addPath = (path: string | undefined): void => {
-    if (!path) return;
-    const trimmed = path.trim();
-    if (!trimmed) return;
-    paths.add(resolveHomePath(trimmed));
-  };
-
-  for (const key of [
-    "sessionLog",
-    "outputLog",
-    "terminalLog",
-    "transcript",
-    "history",
-    "historyFile",
-    "devServerLog",
-  ]) {
-    addPath(values[key]);
-  }
-
-  if (worktree) {
-    const normalizedWorktree = resolveHomePath(worktree);
-    for (const id of [sessionId, tmuxName].filter(Boolean)) {
-      addPath(join(normalizedWorktree, ".conductor", "logs", `${id}.log`));
-      addPath(join(normalizedWorktree, ".conductor", "state", `${id}.log`));
-    }
-    addPath(join(normalizedWorktree, ".conductor", "session.log"));
-    addPath(join(normalizedWorktree, ".codex", "history.jsonl"));
-    addPath(join(normalizedWorktree, ".codex", "log", "codex-tui.log"));
-    addPath(join(normalizedWorktree, ".claude", "logs", `${sessionId}.log`));
-  }
-
-  const snapshotDir = dirname(snapshot.filePath);
-  addPath(join(snapshotDir, `${sessionId}.log`));
-  if (tmuxName) {
-    addPath(join(snapshotDir, `${tmuxName}.log`));
-  }
-  if (snapshotDir.endsWith(`${join("sessions", "archive")}`)) {
-    const sessionsDir = dirname(snapshotDir);
-    addPath(join(sessionsDir, sessionId));
-    addPath(join(sessionsDir, `${sessionId}.log`));
-    if (tmuxName) {
-      addPath(join(sessionsDir, `${tmuxName}.log`));
-    }
-  }
-
-  addPath(snapshot.filePath);
-
-  return [...paths];
-}
-
-function readFallbackOutput(sessionId: string, lines: number): string | null {
-  const snapshot = readLatestSessionSnapshot(sessionId);
-  if (!snapshot) return null;
-
-  const candidates = buildFallbackLogCandidates(sessionId, snapshot);
-  const snapshotPath = resolve(snapshot.filePath);
-
-  for (const candidatePath of candidates) {
-    if (resolve(candidatePath) === snapshotPath) continue;
-    if (!isReadableFile(candidatePath)) continue;
-    try {
-      const content = readFileSync(candidatePath, "utf8");
-      if (!content.trim()) continue;
-      return tailText(content, lines);
-    } catch {
-      continue;
-    }
-  }
-
-  if (isReadableFile(snapshot.filePath)) {
-    try {
-      const content = readFileSync(snapshot.filePath, "utf8");
-      if (content.trim()) {
-        return tailText(content, lines);
-      }
-    } catch {
-      // Ignore and use synthesized output.
-    }
-  }
-
-  const status = snapshot.values["status"] ?? "unknown";
-  const summary = snapshot.values["summary"] ?? "";
-  const branch = snapshot.values["branch"] ?? "";
-  const worktree = snapshot.values["worktree"] ?? "";
-  const metadataDump = Object.entries(snapshot.values)
-    .map(([key, value]) => `${key}=${value}`)
-    .join("\n");
-
-  const fallback = [
-    `[session output fallback] Runtime output unavailable for ${sessionId}.`,
-    `status=${status}`,
-    branch ? `branch=${branch}` : "",
-    worktree ? `worktree=${worktree}` : "",
-    summary ? `summary=${summary}` : "",
-    "",
-    metadataDump,
-  ].filter(Boolean).join("\n");
-
-  return tailText(fallback, lines);
-}
-
-export async function GET(
-  request: NextRequest,
-  context: { params: Promise<{ id: string }> },
-) {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-
-  const params = await context.params;
-  const rawId = params?.id ?? "";
-  let sessionId: string;
-  try {
-    sessionId = decodeURIComponent(rawId).trim();
-  } catch {
-    return NextResponse.json({ error: "Invalid session id" }, { status: 400 });
-  }
-  if (!sessionId) {
-    return NextResponse.json({ error: "Session id is required" }, { status: 400 });
-  }
-
-  const searchParams = new URL(request.url).searchParams;
-  const rawLines = searchParams.get("lines");
-  const parsedLines = rawLines ? Number.parseInt(rawLines, 10) : 500;
-  const lines = Number.isFinite(parsedLines) && parsedLines > 0 ? Math.min(parsedLines, 5000) : 500;
-
-  try {
-    const { sessionManager } = await getServices();
-    try {
-      const output = await sessionManager.getOutput(sessionId, lines);
-      return NextResponse.json({ output });
-    } catch (runtimeErr) {
-      const fallbackOutput = readFallbackOutput(sessionId, lines);
-      if (fallbackOutput !== null) {
-        return NextResponse.json({ output: fallbackOutput, source: "fallback-log" });
-      }
-
-      throw runtimeErr;
-    }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load output";
-    const status = message.toLowerCase().includes("not found") ? 404 : 500;
-    return NextResponse.json({ error: message }, { status });
-  }
-}
+export const GET = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/output`,
+  { role: "viewer" },
+);