cowork-os 0.3.21

package/dist/electron/electron/canvas/canvas-preload.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Canvas Preload Script
+ *
+ * Exposes a secure bridge between the canvas content and the main process.
+ * This preload script is loaded into canvas BrowserWindows and provides:
+ * - A2UI (Agent-to-UI) action sending
+ * - Session information retrieval
+ * - Agent update notifications
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const electron_1 = require("electron");
+// Create the canvas API
+const canvasAPI = {
+    sendA2UIAction: async (actionName, componentId, context) => {
+        await electron_1.ipcRenderer.invoke('canvas:a2ui-action-from-window', {
+            actionName,
+            componentId,
+            context,
+        });
+    },
+    getSessionInfo: async () => {
+        return electron_1.ipcRenderer.invoke('canvas:get-session-from-window');
+    },
+    onAgentUpdate: (callback) => {
+        electron_1.ipcRenderer.on('canvas:agent-update', (_event, data) => {
+            callback(data);
+        });
+    },
+    requestSnapshot: async () => {
+        return electron_1.ipcRenderer.invoke('canvas:request-snapshot-from-window');
+    },
+    log: (message, data) => {
+        electron_1.ipcRenderer.send('canvas:log', { message, data });
+    },
+};
+const shouldExposeCanvasApi = (() => {
+    try {
+        const location = globalThis.location;
+        return location?.protocol === 'canvas:';
+    }
+    catch {
+        return false;
+    }
+})();
+if (shouldExposeCanvasApi) {
+    // Expose the API to trusted canvas:// content only
+    electron_1.contextBridge.exposeInMainWorld('coworkCanvas', canvasAPI);
+    console.log('[CanvasPreload] Canvas preload script loaded (canvas://)');
+}
+else {
+    console.log('[CanvasPreload] Canvas preload script loaded (no API exposed)');
+}

package/dist/electron/electron/canvas/canvas-protocol.js

@@ -0,0 +1,195 @@
+"use strict";
+/**
+ * Canvas Protocol Handler
+ *
+ * Registers a custom 'canvas://' URL scheme that serves files from
+ * canvas session directories to the canvas BrowserWindows.
+ *
+ * URL Format: canvas://{sessionId}/{filename}
+ * Example: canvas://abc123-def456/index.html
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCanvasScheme = registerCanvasScheme;
+exports.registerCanvasProtocol = registerCanvasProtocol;
+const electron_1 = require("electron");
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const canvas_manager_1 = require("./canvas-manager");
+// MIME type mapping
+const MIME_TYPES = {
+    '.html': 'text/html',
+    '.htm': 'text/html',
+    '.css': 'text/css',
+    '.js': 'application/javascript',
+    '.mjs': 'application/javascript',
+    '.json': 'application/json',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.webp': 'image/webp',
+    '.ico': 'image/x-icon',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.otf': 'font/otf',
+    '.eot': 'application/vnd.ms-fontobject',
+    '.wasm': 'application/wasm',
+    '.mp3': 'audio/mpeg',
+    '.mp4': 'video/mp4',
+    '.webm': 'video/webm',
+    '.ogg': 'audio/ogg',
+    '.wav': 'audio/wav',
+    '.pdf': 'application/pdf',
+    '.xml': 'application/xml',
+    '.txt': 'text/plain',
+    '.md': 'text/markdown',
+};
+/**
+ * Get MIME type for a file extension
+ */
+function getMimeType(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    return MIME_TYPES[ext] || 'application/octet-stream';
+}
+/**
+ * Create an error response
+ */
+function createErrorResponse(statusCode, message) {
+    return new Response(message, {
+        status: statusCode,
+        headers: {
+            'Content-Type': 'text/plain',
+        },
+    });
+}
+/**
+ * Register the canvas:// protocol scheme as privileged
+ * Must be called before app.ready
+ */
+function registerCanvasScheme() {
+    electron_1.protocol.registerSchemesAsPrivileged([
+        {
+            scheme: 'canvas',
+            privileges: {
+                standard: true,
+                secure: true,
+                supportFetchAPI: true,
+                corsEnabled: true,
+                stream: true,
+            },
+        },
+    ]);
+}
+/**
+ * Register the canvas:// protocol handler
+ * Must be called after app.ready
+ */
+function registerCanvasProtocol() {
+    electron_1.protocol.handle('canvas', async (request) => {
+        try {
+            const url = new URL(request.url);
+            const sessionId = url.hostname;
+            let filePath = decodeURIComponent(url.pathname);
+            // Security: prevent path traversal attacks
+            if (filePath.includes('..') || filePath.includes('//')) {
+                console.warn(`[CanvasProtocol] Blocked path traversal attempt: ${filePath}`);
+                return createErrorResponse(403, 'Forbidden: Invalid path');
+            }
+            // Get the canvas manager
+            const manager = canvas_manager_1.CanvasManager.getInstance();
+            const session = manager.getSession(sessionId);
+            if (!session) {
+                console.warn(`[CanvasProtocol] Session not found: ${sessionId}`);
+                return createErrorResponse(404, 'Session not found');
+            }
+            // Default to index.html for root requests
+            if (filePath === '/' || filePath === '') {
+                filePath = '/index.html';
+            }
+            // Remove leading slash
+            const relativePath = filePath.startsWith('/') ? filePath.slice(1) : filePath;
+            const fullPath = path.join(session.sessionDir, relativePath);
+            // Security: ensure the resolved path is within the session directory
+            const resolvedPath = path.resolve(fullPath);
+            const resolvedSessionDir = path.resolve(session.sessionDir);
+            if (!resolvedPath.startsWith(resolvedSessionDir)) {
+                console.warn(`[CanvasProtocol] Path escape attempt: ${fullPath}`);
+                return createErrorResponse(403, 'Forbidden: Path outside session');
+            }
+            // Check if file exists
+            if (!fs.existsSync(fullPath)) {
+                console.warn(`[CanvasProtocol] File not found: ${fullPath}`);
+                return createErrorResponse(404, 'File not found');
+            }
+            // Get file stats
+            const stats = fs.statSync(fullPath);
+            if (stats.isDirectory()) {
+                // Try index.html in directory
+                const indexPath = path.join(fullPath, 'index.html');
+                if (fs.existsSync(indexPath)) {
+                    const content = fs.readFileSync(indexPath);
+                    return new Response(content, {
+                        status: 200,
+                        headers: {
+                            'Content-Type': 'text/html',
+                            'Content-Length': content.length.toString(),
+                        },
+                    });
+                }
+                return createErrorResponse(403, 'Directory listing not allowed');
+            }
+            // Read and serve the file
+            const content = fs.readFileSync(fullPath);
+            const mimeType = getMimeType(fullPath);
+            return new Response(content, {
+                status: 200,
+                headers: {
+                    'Content-Type': mimeType,
+                    'Content-Length': content.length.toString(),
+                    'Cache-Control': 'no-cache', // Disable caching for development
+                },
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            console.error('[CanvasProtocol] Error handling request:', error);
+            return createErrorResponse(500, `Internal error: ${message}`);
+        }
+    });
+    console.log('[CanvasProtocol] Registered canvas:// protocol handler');
+}

package/dist/electron/electron/canvas/canvas-store.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * Canvas Store - File-based persistence for canvas sessions
+ * Uses atomic writes with temporary files for data safety
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCanvasDir = getCanvasDir;
+exports.getCanvasStorePath = getCanvasStorePath;
+exports.loadCanvasStore = loadCanvasStore;
+exports.loadCanvasStoreSync = loadCanvasStoreSync;
+exports.saveCanvasStore = saveCanvasStore;
+exports.saveCanvasStoreSync = saveCanvasStoreSync;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const electron_1 = require("electron");
+// Lazy-evaluated paths (app.getPath() is not available until app is ready)
+let _canvasDir = null;
+let _canvasStorePath = null;
+function getCanvasDir() {
+    if (!_canvasDir) {
+        _canvasDir = node_path_1.default.join(electron_1.app.getPath('userData'), 'canvas');
+    }
+    return _canvasDir;
+}
+function getCanvasStorePath() {
+    if (!_canvasStorePath) {
+        _canvasStorePath = node_path_1.default.join(getCanvasDir(), 'sessions.json');
+    }
+    return _canvasStorePath;
+}
+// Maximum sessions to keep (to prevent unbounded growth)
+const MAX_SESSIONS = 50;
+/**
+ * Validate a single canvas session object
+ */
+function isValidSession(s) {
+    if (!s || typeof s !== 'object')
+        return false;
+    const session = s;
+    const mode = session.mode;
+    const isValidMode = mode === undefined || mode === 'html' || mode === 'browser';
+    const url = session.url;
+    const isValidUrl = url === undefined || typeof url === 'string';
+    return (typeof session.id === 'string' &&
+        typeof session.taskId === 'string' &&
+        typeof session.workspaceId === 'string' &&
+        typeof session.sessionDir === 'string' &&
+        isValidMode &&
+        isValidUrl &&
+        typeof session.status === 'string' &&
+        ['active', 'paused', 'closed'].includes(session.status) &&
+        typeof session.createdAt === 'number' &&
+        typeof session.lastUpdatedAt === 'number');
+}
+/**
+ * Load canvas sessions from the store file
+ * Returns empty array if file doesn't exist or is invalid
+ */
+async function loadCanvasStore(storePath) {
+    const effectivePath = storePath || getCanvasStorePath();
+    try {
+        const raw = await node_fs_1.default.promises.readFile(effectivePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        const sessions = Array.isArray(parsed?.sessions) ? parsed.sessions : [];
+        // Validate and filter sessions
+        const validSessions = sessions.filter((s) => {
+            if (!isValidSession(s))
+                return false;
+            // Also verify the session directory still exists
+            try {
+                return node_fs_1.default.existsSync(s.sessionDir);
+            }
+            catch {
+                return false;
+            }
+        });
+        return {
+            version: 1,
+            sessions: validSessions,
+        };
+    }
+    catch {
+        // File doesn't exist or is invalid - return empty store
+        return { version: 1, sessions: [] };
+    }
+}
+/**
+ * Load canvas store synchronously (for initialization)
+ */
+function loadCanvasStoreSync(storePath) {
+    const effectivePath = storePath || getCanvasStorePath();
+    try {
+        const raw = node_fs_1.default.readFileSync(effectivePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        const sessions = Array.isArray(parsed?.sessions) ? parsed.sessions : [];
+        // Validate and filter sessions
+        const validSessions = sessions.filter((s) => {
+            if (!isValidSession(s))
+                return false;
+            // Also verify the session directory still exists
+            try {
+                return node_fs_1.default.existsSync(s.sessionDir);
+            }
+            catch {
+                return false;
+            }
+        });
+        return {
+            version: 1,
+            sessions: validSessions,
+        };
+    }
+    catch {
+        return { version: 1, sessions: [] };
+    }
+}
+/**
+ * Save canvas sessions to the store file
+ * Uses atomic writes to prevent data corruption
+ */
+async function saveCanvasStore(store, storePath) {
+    const effectivePath = storePath || getCanvasStorePath();
+    // Ensure directory exists
+    await node_fs_1.default.promises.mkdir(node_path_1.default.dirname(effectivePath), { recursive: true });
+    // Only keep non-closed sessions, and limit to max
+    let sessionsToSave = store.sessions.filter(s => s.status !== 'closed');
+    // Trim to max sessions (keep most recent)
+    if (sessionsToSave.length > MAX_SESSIONS) {
+        sessionsToSave = sessionsToSave
+            .sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt)
+            .slice(0, MAX_SESSIONS);
+    }
+    const storeToSave = {
+        version: 1,
+        sessions: sessionsToSave,
+    };
+    // Generate temp file path with process ID and random suffix
+    const tmp = `${effectivePath}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+    // Write to temp file
+    const json = JSON.stringify(storeToSave, null, 2);
+    await node_fs_1.default.promises.writeFile(tmp, json, 'utf-8');
+    // Atomic rename
+    await node_fs_1.default.promises.rename(tmp, effectivePath);
+}
+/**
+ * Save canvas store synchronously
+ */
+function saveCanvasStoreSync(store, storePath) {
+    const effectivePath = storePath || getCanvasStorePath();
+    // Ensure directory exists
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(effectivePath), { recursive: true });
+    // Only keep non-closed sessions, and limit to max
+    let sessionsToSave = store.sessions.filter(s => s.status !== 'closed');
+    // Trim to max sessions (keep most recent)
+    if (sessionsToSave.length > MAX_SESSIONS) {
+        sessionsToSave = sessionsToSave
+            .sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt)
+            .slice(0, MAX_SESSIONS);
+    }
+    const storeToSave = {
+        version: 1,
+        sessions: sessionsToSave,
+    };
+    // Generate temp file path
+    const tmp = `${effectivePath}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+    // Write to temp file
+    const json = JSON.stringify(storeToSave, null, 2);
+    node_fs_1.default.writeFileSync(tmp, json, 'utf-8');
+    // Atomic rename
+    node_fs_1.default.renameSync(tmp, effectivePath);
+}

package/dist/electron/electron/canvas/index.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Live Canvas Module
+ *
+ * Agent-driven visual workspace for rendering interactive HTML/CSS/JS content.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCanvasProtocol = exports.registerCanvasScheme = exports.CanvasManager = void 0;
+var canvas_manager_1 = require("./canvas-manager");
+Object.defineProperty(exports, "CanvasManager", { enumerable: true, get: function () { return canvas_manager_1.CanvasManager; } });
+var canvas_protocol_1 = require("./canvas-protocol");
+Object.defineProperty(exports, "registerCanvasScheme", { enumerable: true, get: function () { return canvas_protocol_1.registerCanvasScheme; } });
+Object.defineProperty(exports, "registerCanvasProtocol", { enumerable: true, get: function () { return canvas_protocol_1.registerCanvasProtocol; } });