conductor-oss 0.2.4 → 0.2.6

package/web/.next/standalone/packages/web/src/app/api/spawn/route.ts

@@ -5,7 +5,7 @@ import { syncWorkspaceSupportFiles } from "@conductor-oss/core";
 import { getServices, invalidateServicesCache } from "@/lib/services";
 import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
 import { sessionToDashboard } from "@/lib/serialize";
-import { syncProjectLocalConfig } from "@/lib/projectConfigSync";
+import { normalizeRootProjectPaths, syncProjectLocalConfig } from "@/lib/projectConfigSync";
 
 /** POST /api/spawn -- Spawn a new agent session. */
 
@@ -39,6 +39,7 @@ async function persistSpawnAgentSelection(configPath: string, projectId: string,
     ...nextPreferences,
     codingAgent: agent,
   };
+  await normalizeRootProjectPaths(nextRoot);
 
   const updatedYaml = stringify(nextRoot, { lineWidth: 0 });
   await writeFile(configPath, updatedYaml, "utf8");
@@ -58,7 +59,7 @@ async function persistSpawnAgentSelection(configPath: string, projectId: string,
 }
 
 export async function POST(request: NextRequest) {
-  const denied = await guardApiAccess();
+  const denied = await guardApiAccess(request, "operator");
   if (denied) return denied;
   const deniedAction = guardApiActionAccess(request);
   if (deniedAction) return deniedAction;

package/web/.next/standalone/packages/web/src/app/api/workspaces/branches/route.ts

@@ -98,7 +98,7 @@ async function listLocalBranches(path: string): Promise<{ branches: string[]; de
 }
 
 export async function GET(request: NextRequest) {
-  const denied = await guardApiAccess();
+  const denied = await guardApiAccess(undefined, "viewer");
   if (denied) return denied;
 
   const gitUrl = asNonEmpty(request.nextUrl.searchParams.get("gitUrl"));

package/web/.next/standalone/packages/web/src/app/api/workspaces/route.ts

@@ -9,11 +9,12 @@ import {
   buildConductorBoard,
   buildProjectConfigRecord,
   generateSessionPrefix,
+  getDefaultAgentModel,
   syncWorkspaceSupportFiles,
 } from "@conductor-oss/core";
 import { getServices, invalidateServicesCache } from "@/lib/services";
 import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
-import { syncProjectLocalConfig } from "@/lib/projectConfigSync";
+import { normalizeRootProjectPaths, syncProjectLocalConfig } from "@/lib/projectConfigSync";
 
 const execFileAsync = promisify(execFile);
 
@@ -218,6 +219,7 @@ function buildProjectPayload(args: {
   repo: string;
   defaultBranch: string;
   agent: string;
+  agentModel?: string | null;
   sessionPrefix: string;
   useWorktree: boolean;
 }): Record<string, unknown> {
@@ -228,6 +230,7 @@ function buildProjectPayload(args: {
     repo: args.repo,
     defaultBranch: args.defaultBranch,
     agent: args.agent,
+    agentModel: args.agentModel ?? null,
     sessionPrefix: args.sessionPrefix,
     workspace: args.useWorktree ? "worktree" : "local",
     runtime: "tmux",
@@ -282,6 +285,7 @@ async function writeProjectToConfig(args: {
   const nextProjects = toProjectMap(nextRoot.projects);
   nextProjects[args.projectId] = args.projectData;
   nextRoot.projects = nextProjects;
+  await normalizeRootProjectPaths(nextRoot);
 
   const updatedYaml = stringify(nextRoot, {
     lineWidth: 0,
@@ -321,7 +325,7 @@ export const dynamic = "force-dynamic";
  * Returns all configured projects/workspaces from conductor.yaml.
  */
 export async function GET() {
-  const denied = await guardApiAccess();
+  const denied = await guardApiAccess(undefined, "viewer");
   if (denied) return denied;
 
   try {
@@ -348,7 +352,7 @@ export async function GET() {
  * Supports both remote git clone and local/non-git folders.
  */
 export async function POST(request: NextRequest) {
-  const denied = await guardApiAccess();
+  const denied = await guardApiAccess(request, "operator");
   if (denied) return denied;
   const deniedAction = guardApiActionAccess(request);
   if (deniedAction) return deniedAction;
@@ -436,6 +440,7 @@ export async function POST(request: NextRequest) {
       const defaultBranch = requestedDefaultBranchRaw ?? detectedDefaultBranch;
       const repoValue = extractRepoNameFromGitUrl(gitUrl) ?? gitUrl;
       const sessionPrefix = createUniqueSessionPrefix(targetPath, config.projects);
+      const agentModel = getDefaultAgentModel(requestedAgent, config.preferences?.modelAccess ?? null);
 
       await writeProjectToConfig({
         configPath,
@@ -446,6 +451,7 @@ export async function POST(request: NextRequest) {
           repo: repoValue,
           defaultBranch,
           agent: requestedAgent,
+          agentModel,
           sessionPrefix,
           useWorktree,
         }),
@@ -525,6 +531,7 @@ export async function POST(request: NextRequest) {
 
     const repoValue = (await getOriginRepo(localPath)) ?? `local-${projectId}`;
     const sessionPrefix = createUniqueSessionPrefix(localPath, config.projects);
+    const agentModel = getDefaultAgentModel(requestedAgent, config.preferences?.modelAccess ?? null);
 
     await writeProjectToConfig({
       configPath,
@@ -535,6 +542,7 @@ export async function POST(request: NextRequest) {
         repo: repoValue,
         defaultBranch,
         agent: requestedAgent,
+        agentModel,
         sessionPrefix,
         useWorktree,
       }),

package/web/.next/standalone/packages/web/src/app/auth/grant/route.ts

@@ -0,0 +1,37 @@
+import { type NextRequest, NextResponse } from "next/server";
+import {
+  BUILTIN_REMOTE_SESSION_COOKIE,
+  createBuiltinRemoteSessionValue,
+  getBuiltinRemoteSessionCookieOptions,
+  isBuiltinRemoteAuthEnabled,
+  isValidBuiltinAccessToken,
+  sanitizeRedirectTarget,
+} from "@/lib/remoteAuth";
+
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const nextPath = sanitizeRedirectTarget(request.nextUrl.searchParams.get("next"));
+  const unlockUrl = new URL("/unlock", request.url);
+  if (nextPath !== "/") {
+    unlockUrl.searchParams.set("next", nextPath);
+  }
+
+  if (!isBuiltinRemoteAuthEnabled()) {
+    unlockUrl.searchParams.set("error", "unavailable");
+    return NextResponse.redirect(unlockUrl);
+  }
+
+  const token = request.nextUrl.searchParams.get("token");
+  if (!isValidBuiltinAccessToken(token)) {
+    unlockUrl.searchParams.set("error", "invalid");
+    return NextResponse.redirect(unlockUrl);
+  }
+
+  const redirectUrl = new URL(nextPath, request.url);
+  const response = NextResponse.redirect(redirectUrl);
+  response.cookies.set(
+    BUILTIN_REMOTE_SESSION_COOKIE,
+    await createBuiltinRemoteSessionValue(),
+    getBuiltinRemoteSessionCookieOptions(request.nextUrl.protocol === "https:"),
+  );
+  return response;
+}