npm - coxpit - Versions diffs - 5.21.0 → 5.23.0 - Mend

coxpit 5.21.0 → 5.23.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md CHANGED Viewed

@@ -96,6 +96,7 @@ Runs land in the project like any board-launched run (isolated worktree + branch
 | `COXPIT_HOST` / `COXPIT_PORT` | `127.0.0.1` / `8210` | daemon bind. If the port is busy the daemon **auto-moves to the next free port** (see the startup log / lock file for the actual one) |
 | `COXPIT_PORT_STRICT` | — | `1` = fail instead of auto-moving when the port is busy (pin a fixed port behind a reverse proxy) |
 | `COXPIT_DB` | `~/.coxpit/coxpit.db` | SQLite (libSQL) file (a legacy `./coxpit.db` in the cwd is still honored) |
+| `COXPIT_FILES_ROOT` | `~` (home) | root the built-in file viewer may read/edit within. `/` opens the whole filesystem. Also settable in **Settings → File viewer** (applies immediately, no restart); env wins and locks the field. An authed user already has a full shell (the terminal), so this is defense-in-depth for an exposed daemon, not real confinement — widen it on a box you trust |
 | `COXPIT_AUTH_PASS` | — | access key (back-compat, key-only). If set on an **exposed** bind, the branded unlock page asks for this key — no username. Empty = use the stored key, or first-run setup |
 | `COXPIT_AUTH_DISABLED` | — | `1` forces auth **off** (delegate to a front gateway like Cloudflare Access / Tailscale) |
 | `COXPIT_SSH_KEY` | — | private key for remote machines (else ssh defaults/agent) |

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "coxpit",
-  "version": "5.21.0",
+  "version": "5.23.0",
   "description": "Self-hosted cockpit for running a fleet of AI coding agents across your own machines — parallel worktree runs, live board, compare & merge, web terminal, design capture.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/board.ts CHANGED Viewed

@@ -1781,6 +1781,11 @@ async function renderSettings(){
         + '<input id="setHost" value="'+escA(ef.host)+'" placeholder="127.0.0.1"'+dis(L.host)+'></label>'
       + '<div class="set-note">Port and host apply on the next daemon restart.</div>'
     + '</div>'
+    + '<div class="set-sec"><div class="set-h">File viewer</div>'
+      + '<label class="set-row"><span class="set-lbl">Viewer root '+lockNote(L.filesRoot,'COXPIT_FILES_ROOT')+'</span>'
+        + '<input id="setFilesRoot" value="'+escA(ef.filesRoot||'')+'" placeholder="home (default) — set / for the whole filesystem"'+dis(L.filesRoot)+'></label>'
+      + '<div class="set-note">Folders the file viewer may open. Empty = your home folder; <code>/</code> = the whole filesystem; or an absolute path. Applies immediately. An authed user already has a full shell (the terminal), so this bounds an exposed daemon, not real confinement.</div>'
+    + '</div>'
     + '<div class="set-sec"><div class="set-h">Access key</div>'
       + '<div class="set-state">'+esc(keyState)+'</div>'
       + (au.canManage
@@ -1827,6 +1832,7 @@ function wireSettings(){
     const body = { agent:{} };
     if (!L.port){ body.port = Number($('setPort').value); body.portStrict = $('setStrict').checked; }
     if (!L.host) body.host = $('setHost').value.trim();
+    if (!L.filesRoot) body.filesRoot = $('setFilesRoot').value.trim();
     if (!L.webhookUrl) body.webhookUrl = $('setWebhook').value.trim();
     if (!L.publicUrl) body.publicUrl = $('setPublic').value.trim();
     body.agent.provider = $('setProv').value;

package/src/cockpit.ts CHANGED Viewed

@@ -57,7 +57,8 @@ export const COCKPIT_HTML = /* html */ `<!doctype html>
   .layout > *{min-height:0;min-width:0}
   /* ── workspace tree ── */
-  .rail{border-right:1px solid var(--line);overflow:auto;padding:10px 8px;font-family:var(--mono);font-size:12.5px;display:flex;flex-direction:column}
+  .rail{border-right:1px solid var(--line);overflow:auto;padding:10px 8px;font-family:var(--mono);font-size:12.5px;display:flex;flex-direction:column;scrollbar-width:none;-ms-overflow-style:none}
+  .rail::-webkit-scrollbar{width:0;height:0;display:none}   /* 스크롤 UI 제거(흰 바), 스크롤 기능은 유지 */
   .lbl{font-size:10px;letter-spacing:.14em;text-transform:uppercase;color:var(--faint);padding:6px 8px 10px;display:flex;justify-content:space-between}
   .tnode{display:flex;align-items:center;gap:8px;padding:6px 8px;border-radius:7px;color:var(--muted);white-space:nowrap;cursor:default}
   .tnode .car{color:var(--faint);width:9px;display:inline-block;text-align:center;cursor:pointer}

package/src/config.ts CHANGED Viewed

@@ -46,7 +46,7 @@ const settingsPath = path.join(path.dirname(path.resolve(dbPath)), 'settings.jso
 // 영속 설정(settings.json)을 인라인으로 읽는다(순환 import 회피 — settings.ts 는 config 를 import).
 // 병합 우선순위: 명시 env > settings.json > 기본값.
 interface StoredSettings {
-  port?: number; portStrict?: boolean; host?: string; webhookUrl?: string; publicUrl?: string;
+  port?: number; portStrict?: boolean; host?: string; filesRoot?: string; webhookUrl?: string; publicUrl?: string;
   agent?: { provider?: string; model?: string; count?: number; real?: boolean };
 }
 const stored: StoredSettings = (() => {
@@ -75,6 +75,7 @@ export const config = {
   // UTF-8 보장된 로케일 — PTY/원격 셸에 명시 전달용
   lang: process.env.LANG!,
   host: env.COXPIT_HOST ?? stored.host ?? '127.0.0.1',
+  filesRoot: env.COXPIT_FILES_ROOT ?? stored.filesRoot ?? '',   // '' = home; '/' = whole fs (file viewer)
   // 선호 포트(env > settings > 8210). 점유 시 index.ts 가 자동 이동(portStrict 면 실패).
   port: num(env.COXPIT_PORT) ?? stored.port ?? 8210,
   // 포트 점유 시 자동 이동 대신 실패(리버스 프록시 등 고정 포트가 필수인 경우).
@@ -105,6 +106,7 @@ export const config = {
   envLocked: {
     port: env.COXPIT_PORT != null,
     host: env.COXPIT_HOST != null,
+    filesRoot: env.COXPIT_FILES_ROOT != null,
     webhookUrl: env.COXPIT_WEBHOOK_URL != null,
     publicUrl: env.COXPIT_PUBLIC_URL != null,
     real: env.COXPIT_AGENT_REAL != null,

package/src/files.ts CHANGED Viewed

@@ -1,14 +1,33 @@
-// File viewer/edit backing (owner-only tool). Scoped to the daemon user's home
-// directory — reading file *contents* is higher-risk than /api/browse's dir listing,
-// so we jail here. All real work (repos, worktrees, sessions, ~/services) lives under ~.
+// File viewer/edit backing (owner-only tool). Scoped to a root — default the
+// daemon user's home. coxpit already grants a full shell to an authed user (the
+// terminal), so this jail is defense-in-depth for an *exposed* daemon, not a real
+// confinement; widen it with COXPIT_FILES_ROOT ("/" = whole filesystem) on a box
+// you trust. Everything under ~ (repos, worktrees, sessions, ~/services) is in the
+// default root.
 import { readdir, stat, readFile, writeFile, realpath } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { resolve as presolve, dirname as pdirname, join as pjoin, basename as pbasename, extname as pextname } from 'node:path';
+import { readSettings } from './settings';
 const HOME = presolve(homedir());
 const MAX_TEXT = 2 * 1024 * 1024;      // read as text up to 2MB
 const MAX_WRITE = 512 * 1024;          // edit-save cap (.env etc. are tiny)
+// Allowed root for reads/edits — resolved per call so the in-app Settings change
+// takes effect immediately (no restart). Precedence: env > settings.json > home.
+// "" = home, "/" = whole filesystem.
+function currentRoot(): string {
+  const r = process.env.COXPIT_FILES_ROOT || readSettings().filesRoot || HOME;
+  return presolve(r || HOME);
+}
+function withinRoot(full: string, root: string): boolean {
+  return root === '/' || full === root || full.startsWith(root + '/');
+}
+// Where listing/search start when no path is given (familiar), still within root.
+function startDir(root: string): string {
+  return (HOME === root || HOME.startsWith(root + '/')) ? HOME : root;
+}
 export type FileKind = 'md' | 'html' | 'pdf' | 'image' | 'text' | 'binary';
 const IMAGE_EXT = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg', '.bmp', '.ico', '.avif']);
@@ -49,19 +68,20 @@ export function mimeFor(p: string): string {
   return MIME[ext(p)] || 'application/octet-stream';
 }
-// Reject anything that escapes HOME (symlink-safe via realpath on the closest existing ancestor).
+// Reject anything that escapes the root (symlink-safe via realpath on the closest existing ancestor).
 async function jail(input?: string): Promise<string> {
-  const p = presolve(input && input.startsWith('/') ? input : HOME);
+  const root = currentRoot();
+  const p = presolve(input && input.startsWith('/') ? input : startDir(root));
   // realpath the deepest existing ancestor so a missing leaf (new file) still validates its dir
   let probe = p;
   for (;;) {
     try { const rp = await realpath(probe); const rest = p.slice(probe.length); const full = presolve(rp + rest);
-      if (full !== HOME && !full.startsWith(HOME + '/')) throw new Error('outside home');
+      if (!withinRoot(full, root)) throw new Error('outside root');
       return full;
     } catch (e: any) {
-      if (e && e.message === 'outside home') throw e;
+      if (e && e.message === 'outside root') throw e;
       const parent = pdirname(probe);
-      if (parent === probe) { if (p !== HOME && !p.startsWith(HOME + '/')) throw new Error('outside home'); return p; }
+      if (parent === probe) { if (!withinRoot(p, root)) throw new Error('outside root'); return p; }
       probe = parent;
     }
   }
@@ -122,7 +142,12 @@ function friendly(e: any): Error {
   if (code === 'ENOENT') return new Error('파일을 찾을 수 없습니다');
   if (code === 'EISDIR') return new Error('폴더입니다');
   if (code === 'EACCES' || code === 'EPERM') return new Error('열 권한이 없습니다');
-  if (e && e.message === 'outside home') return new Error('홈 폴더 밖이라 열 수 없습니다');
+  if (e && e.message === 'outside root') {
+    const root = currentRoot();
+    return new Error(root === HOME
+      ? '홈 폴더 밖이라 열 수 없습니다 (설정 → 파일 뷰어 루트에서 넓힐 수 있음)'
+      : '허용된 폴더 밖이라 열 수 없습니다 (' + root + ')');
+  }
   return new Error(String((e && e.message) || e));
 }

package/src/server.ts CHANGED Viewed

@@ -365,7 +365,7 @@ export async function buildServer(): Promise<FastifyInstance> {
     const m = authMode();
     return {
       effective: {
-        port: config.port, portStrict: config.portStrict, host: config.host,
+        port: config.port, portStrict: config.portStrict, host: config.host, filesRoot: config.filesRoot,
         webhookUrl: config.webhookUrl, publicUrl: config.publicUrl,
         agent: { provider: config.agent.provider, model: config.agent.model, count: config.agent.count, real: config.agent.real },
       },
@@ -380,11 +380,16 @@ export async function buildServer(): Promise<FastifyInstance> {
   // 부분 저장. env 로 고정된 필드는 무시(파일이 env 를 못 이김). 포트·호스트는 재시작 반영.
   app.patch('/api/settings', async (req, reply) => {
     const b = (req.body ?? {}) as {
-      port?: unknown; portStrict?: unknown; host?: unknown; webhookUrl?: unknown; publicUrl?: unknown;
+      port?: unknown; portStrict?: unknown; host?: unknown; filesRoot?: unknown; webhookUrl?: unknown; publicUrl?: unknown;
       agent?: { provider?: unknown; model?: unknown; count?: unknown; real?: unknown };
     };
     const patch: Record<string, unknown> = {};
     const L = config.envLocked;
+    if (!L.filesRoot && b.filesRoot !== undefined) {
+      const fr = String(b.filesRoot).trim();
+      if (fr !== '' && !fr.startsWith('/')) return reply.code(400).send({ error: 'file viewer root must be an absolute path, "/" for the whole filesystem, or empty for home' });
+      patch.filesRoot = fr;   // applies immediately (files.ts resolves per request)
+    }
     if (!L.port && b.port !== undefined) {
       const p = Number(b.port);
       if (!Number.isInteger(p) || p < 1 || p > 65535) return reply.code(400).send({ error: 'port must be 1–65535' });

package/src/settings.ts CHANGED Viewed

@@ -9,6 +9,7 @@ export interface Settings {
   port?: number;
   portStrict?: boolean;
   host?: string;
+  filesRoot?: string;   // 파일 뷰어 루트(빈값=홈, "/"=전체). 즉시 반영(재시작 불요).
   webhookUrl?: string;
   publicUrl?: string;
   agent?: {