conductor-oss 0.2.20 → 0.3.1

package/web/.next/standalone/packages/web/src/app/api/spawn/route.ts

@@ -1,216 +1,5 @@
-import { type NextRequest, NextResponse } from "next/server";
-import { readFile, writeFile } from "node:fs/promises";
-import { parse, stringify } from "yaml";
-import { normalizeProjectConfigMap, syncWorkspaceSupportFiles } from "@conductor-oss/core";
-import { getServices, invalidateServicesCache } from "@/lib/services";
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
-import { sessionToDashboard } from "@/lib/serialize";
-import { normalizeRootProjectPaths, syncProjectLocalConfig } from "@/lib/projectConfigSync";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
-/** POST /api/spawn -- Spawn a new agent session. */
+export const dynamic = "force-dynamic";
 
-type MutableConfig = Record<string, unknown>;
-
-function toObject(value: unknown): Record<string, unknown> {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return {};
-  }
-  return { ...(value as Record<string, unknown>) };
-}
-
-async function persistSpawnAgentSelection(configPath: string, projectId: string, agent: string): Promise<void> {
-  const originalConfigRaw = await readFile(configPath, "utf8");
-  const parsed = (parse(originalConfigRaw) ?? {}) as MutableConfig;
-  const nextRoot: MutableConfig =
-    parsed && typeof parsed === "object" && !Array.isArray(parsed)
-      ? { ...parsed }
-      : {};
-
-  const nextProjects = normalizeProjectConfigMap(nextRoot["projects"]);
-  const existingProject = toObject(nextProjects[projectId]);
-  nextProjects[projectId] = {
-    ...existingProject,
-    agent,
-  };
-  nextRoot["projects"] = nextProjects;
-
-  const nextPreferences = toObject(nextRoot["preferences"]);
-  nextRoot["preferences"] = {
-    ...nextPreferences,
-    codingAgent: agent,
-  };
-  await normalizeRootProjectPaths(nextRoot);
-
-  const updatedYaml = stringify(nextRoot, { lineWidth: 0 });
-  await writeFile(configPath, updatedYaml, "utf8");
-
-  try {
-    invalidateServicesCache("spawn agent selection updated");
-    const { config: refreshedConfig, registry } = await getServices();
-    await syncProjectLocalConfig(refreshedConfig as unknown as Record<string, unknown>, projectId);
-    syncWorkspaceSupportFiles(refreshedConfig, {
-      agentNames: registry.list("agent").map((agent) => agent.name),
-    });
-  } catch (err) {
-    await writeFile(configPath, originalConfigRaw, "utf8");
-    invalidateServicesCache("spawn agent selection rollback");
-    throw err;
-  }
-}
-
-export async function POST(request: NextRequest) {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  const body = (await request.json().catch(() => null)) as Record<string, unknown> | null;
-  if (!body) {
-    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
-  }
-
-  const projectId = body.projectId;
-  if (typeof projectId !== "string" || projectId.trim().length === 0) {
-    return NextResponse.json(
-      { error: "projectId is required and must be a non-empty string" },
-      { status: 400 },
-    );
-  }
-
-  const issueId = body.issueId;
-  if (issueId !== undefined && issueId !== null && typeof issueId !== "string") {
-    return NextResponse.json(
-      { error: "issueId must be a string if provided" },
-      { status: 400 },
-    );
-  }
-
-  const prompt = body.prompt;
-  if (prompt !== undefined && prompt !== null && typeof prompt !== "string") {
-    return NextResponse.json(
-      { error: "prompt must be a string if provided" },
-      { status: 400 },
-    );
-  }
-
-  const agent = body.agent;
-  if (agent !== undefined && agent !== null && typeof agent !== "string") {
-    return NextResponse.json(
-      { error: "agent must be a string if provided" },
-      { status: 400 },
-    );
-  }
-
-  const model = body.model;
-  if (model !== undefined && model !== null && typeof model !== "string") {
-    return NextResponse.json(
-      { error: "model must be a string if provided" },
-      { status: 400 },
-    );
-  }
-
-  const reasoningEffort = body.reasoningEffort;
-  if (reasoningEffort !== undefined && reasoningEffort !== null && typeof reasoningEffort !== "string") {
-    return NextResponse.json(
-      { error: "reasoningEffort must be a string if provided" },
-      { status: 400 },
-    );
-  }
-
-  const profile = body.profile;
-  if (profile !== undefined && profile !== null && typeof profile !== "string") {
-    return NextResponse.json(
-      { error: "profile must be a string if provided" },
-      { status: 400 },
-    );
-  }
-
-  const branch = body.branch;
-  if (branch !== undefined && branch !== null && typeof branch !== "string") {
-    return NextResponse.json(
-      { error: "branch must be a string if provided" },
-      { status: 400 },
-    );
-  }
-
-  const baseBranch = body.baseBranch;
-  if (baseBranch !== undefined && baseBranch !== null && typeof baseBranch !== "string") {
-    return NextResponse.json(
-      { error: "baseBranch must be a string if provided" },
-      { status: 400 },
-    );
-  }
-
-  const normalizedProjectId = projectId.trim();
-  const normalizedIssueId = typeof issueId === "string" && issueId.trim().length > 0
-    ? issueId.trim()
-    : undefined;
-  const normalizedPrompt = typeof prompt === "string" && prompt.trim().length > 0
-    ? prompt.trim()
-    : undefined;
-  const normalizedAgent = typeof agent === "string" && agent.trim().length > 0
-    ? agent.trim()
-    : undefined;
-  const normalizedModel = typeof model === "string" && model.trim().length > 0
-    ? model.trim()
-    : undefined;
-  const normalizedReasoningEffort = typeof reasoningEffort === "string" && reasoningEffort.trim().length > 0
-    ? reasoningEffort.trim().toLowerCase()
-    : undefined;
-  const normalizedProfile = typeof profile === "string" && profile.trim().length > 0
-    ? profile.trim()
-    : undefined;
-  const normalizedBranch = typeof branch === "string" && branch.trim().length > 0
-    ? branch.trim()
-    : undefined;
-  const normalizedBaseBranch = typeof baseBranch === "string" && baseBranch.trim().length > 0
-    ? baseBranch.trim()
-    : undefined;
-
-  try {
-    const { sessionManager, config } = await getServices();
-    if (!config.projects[normalizedProjectId]) {
-      return NextResponse.json(
-        { error: `Unknown project: ${normalizedProjectId}` },
-        { status: 404 },
-      );
-    }
-
-    if (!normalizedPrompt && !normalizedIssueId) {
-      return NextResponse.json(
-        { error: "Either prompt or issueId is required to create a workspace" },
-        { status: 400 },
-      );
-    }
-
-    if (normalizedAgent && config.configPath) {
-      const currentProjectAgent = config.projects[normalizedProjectId]?.agent;
-      const currentPreferredAgent = config.preferences?.codingAgent;
-      if (normalizedAgent !== currentProjectAgent || normalizedAgent !== currentPreferredAgent) {
-        await persistSpawnAgentSelection(config.configPath, normalizedProjectId, normalizedAgent);
-      }
-    }
-
-    const session = await sessionManager.spawn({
-      projectId: normalizedProjectId,
-      issueId: normalizedIssueId,
-      prompt: normalizedPrompt,
-      agent: normalizedAgent,
-      model: normalizedModel,
-      reasoningEffort: normalizedReasoningEffort,
-      profile: normalizedProfile,
-      branch: normalizedBranch,
-      baseBranch: normalizedBaseBranch,
-    });
-
-    return NextResponse.json(
-      { session: sessionToDashboard(session) },
-      { status: 201 },
-    );
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to spawn session" },
-      { status: 500 },
-    );
-  }
-}
+export const POST = guardedProxyRoute("/api/spawn", { role: "operator", requireActionGuard: true });

package/web/.next/standalone/packages/web/src/app/api/workspaces/branches/route.ts

@@ -1,233 +1,5 @@
-import { NextRequest, NextResponse } from "next/server";
-import { promisify } from "node:util";
-import { execFile } from "node:child_process";
-import { realpath, stat } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute, relative, resolve } from "node:path";
-import { guardApiAccess } from "@/lib/auth";
-
-const execFileAsync = promisify(execFile);
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-const HOME_ROOT = homedir();
-const VOLUMES_ROOT = "/Volumes";
-const ALLOWED_REMOTE_PROTOCOLS = new Set(["https:", "http:", "ssh:", "git:"]);
-const SAFE_SEGMENT_PATTERN = /^[^/\\\0\r\n]+$/;
-
-function asNonEmpty(value: string | null): string | null {
-  if (!value) return null;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-
-class InputError extends Error {}
-
-function expandHome(path: string): string {
-  if (path.startsWith("~/")) {
-    return resolve(HOME_ROOT, path.slice(2));
-  }
-  return resolve(path);
-}
-
-function ensureWithinRoot(root: string, candidatePath: string) {
-  const rel = relative(root, candidatePath);
-  if (rel !== "" && (rel.startsWith("..") || isAbsolute(rel))) {
-    throw new InputError("Path is outside the allowed repository roots");
-  }
-}
-
-function normalizeScpStyleRemote(value: string): string | null {
-  const match = value.match(
-    /^(?<user>[A-Za-z0-9._-]+)@(?<host>[A-Za-z0-9.-]+):(?<repo>[A-Za-z0-9._~/-]+(?:\.git)?)$/,
-  );
-  if (!match?.groups) return null;
-  const { user, host, repo } = match.groups;
-  return `ssh://${user}@${host}/${repo}`;
-}
-
-function normalizeGitRemote(rawValue: string): string {
-  if (/[\0\r\n]/.test(rawValue) || rawValue.startsWith("-")) {
-    throw new InputError("Invalid gitUrl");
-  }
-
-  const candidate = normalizeScpStyleRemote(rawValue) ?? rawValue;
-  const url = new URL(candidate);
-
-  if (!ALLOWED_REMOTE_PROTOCOLS.has(url.protocol) || !url.hostname || url.search || url.hash) {
-    throw new InputError("Unsupported gitUrl");
-  }
-
-  if (url.hostname.startsWith("-")) {
-    throw new InputError("Unsupported gitUrl");
-  }
-
-  const normalizedPathname = url.pathname.replace(/\/+$/, "");
-  if (normalizedPathname.length <= 1) {
-    throw new InputError("gitUrl must include a repository path");
-  }
-
-  const normalized = new URL(`${url.protocol}//${url.host}${normalizedPathname}`);
-  if (url.username) {
-    normalized.username = url.username;
-  }
-  return normalized.toString();
-}
-
-async function resolveLocalRepoPath(rawPath: string): Promise<string> {
-  const trimmed = rawPath.trim();
-  if (/[\0\r\n]/.test(trimmed)) {
-    throw new InputError("Invalid path");
-  }
-
-  let root: string;
-  let relativePath: string;
-
-  if (trimmed === "~" || trimmed === HOME_ROOT) {
-    root = HOME_ROOT;
-    relativePath = "";
-  } else if (trimmed.startsWith("~/")) {
-    root = HOME_ROOT;
-    relativePath = trimmed.slice(2);
-  } else if (trimmed.startsWith(`${HOME_ROOT}/`)) {
-    root = HOME_ROOT;
-    relativePath = trimmed.slice(HOME_ROOT.length + 1);
-  } else if (trimmed === VOLUMES_ROOT) {
-    root = VOLUMES_ROOT;
-    relativePath = "";
-  } else if (trimmed.startsWith(`${VOLUMES_ROOT}/`)) {
-    root = VOLUMES_ROOT;
-    relativePath = trimmed.slice(VOLUMES_ROOT.length + 1);
-  } else {
-    throw new InputError("Path is outside the allowed repository roots");
-  }
-
-  const canonicalRoot = await realpath(root);
-  const segments = relativePath
-    .split("/")
-    .filter(Boolean)
-    .map((segment) => {
-      if (!SAFE_SEGMENT_PATTERN.test(segment) || segment === "." || segment === "..") {
-        throw new InputError("Invalid path segment");
-      }
-      return segment;
-    });
-
-  let currentPath = canonicalRoot;
-
-  for (const segment of segments) {
-    const candidatePath = expandHome(resolve(currentPath, segment));
-    const candidateStat = await stat(candidatePath);
-    if (!candidateStat.isDirectory()) {
-      throw new InputError("Path must be a directory");
-    }
-
-    const canonicalCandidate = await realpath(candidatePath);
-    ensureWithinRoot(canonicalRoot, canonicalCandidate);
-    currentPath = canonicalCandidate;
-  }
-
-  return currentPath;
-}
-
-function dedupeAndSortBranches(branches: string[]): string[] {
-  const normalized = branches
-    .map((branch) => branch.trim())
-    .filter((branch) => branch.length > 0)
-    .map((branch) => branch.replace(/^origin\//, ""));
-
-  return [...new Set(normalized)].sort((left, right) => left.localeCompare(right));
-}
-
-async function readRemoteDefaultBranch(gitUrl: string): Promise<string | null> {
-  try {
-    const { stdout } = await execFileAsync(
-      "git",
-      ["ls-remote", "--symref", "--", gitUrl, "HEAD"],
-      { timeout: 30_000 },
-    );
-    const line = stdout
-      .split("\n")
-      .find((entry) => entry.startsWith("ref: refs/heads/"));
-    if (!line) return null;
-    const match = line.match(/^ref:\s+refs\/heads\/([^\s]+)\s+HEAD$/);
-    return match?.[1] ?? null;
-  } catch {
-    return null;
-  }
-}
-
-async function listRemoteBranches(gitUrl: string): Promise<{ branches: string[]; defaultBranch: string | null }> {
-  const { stdout } = await execFileAsync(
-    "git",
-    ["ls-remote", "--heads", "--refs", "--", gitUrl],
-    { timeout: 30_000 },
-  );
-
-  const branches = stdout
-    .split("\n")
-    .map((line) => line.trim())
-    .filter((line) => line.length > 0)
-    .map((line) => {
-      const ref = line.split("\t")[1] ?? "";
-      return ref.replace("refs/heads/", "");
-    })
-    .filter(Boolean);
-
-  const defaultBranch = await readRemoteDefaultBranch(gitUrl);
-  return {
-    branches: dedupeAndSortBranches(branches),
-    defaultBranch,
-  };
-}
-
-async function listLocalBranches(path: string): Promise<{ branches: string[]; defaultBranch: string | null }> {
-  const { stdout } = await execFileAsync(
-    "git",
-    ["for-each-ref", "--format=%(refname:short)", "refs/heads", "refs/remotes/origin"],
-    { timeout: 20_000, cwd: path },
-  );
-
-  const defaultBranchRaw = await execFileAsync(
-    "git",
-    ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"],
-    { timeout: 20_000, cwd: path },
-  ).then((result) => result.stdout.trim()).catch(() => "");
-
-  const branches = stdout.split("\n").filter(Boolean);
-  const defaultBranch = defaultBranchRaw.startsWith("origin/")
-    ? defaultBranchRaw.slice("origin/".length)
-    : null;
-
-  return {
-    branches: dedupeAndSortBranches(branches),
-    defaultBranch,
-  };
-}
-
-export async function GET(request: NextRequest) {
-  const denied = await guardApiAccess(undefined, "viewer");
-  if (denied) return denied;
-
-  const gitUrl = asNonEmpty(request.nextUrl.searchParams.get("gitUrl"));
-  const rawPath = asNonEmpty(request.nextUrl.searchParams.get("path"));
-
-  if (!gitUrl && !rawPath) {
-    return NextResponse.json({ error: "Provide either gitUrl or path" }, { status: 400 });
-  }
-
-  try {
-    if (rawPath) {
-      const path = await resolveLocalRepoPath(rawPath);
-      const payload = await listLocalBranches(path);
-      return NextResponse.json({ ...payload, source: "local" });
-    }
-
-    const payload = await listRemoteBranches(normalizeGitRemote(gitUrl!));
-    return NextResponse.json({ ...payload, source: "remote" });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load branches";
-    const status = err instanceof InputError ? 400 : 500;
-    return NextResponse.json({ error: message }, { status });
-  }
-}
+export const GET = guardedProxyRoute("/api/workspaces/branches", { role: "viewer" });