crewx 0.8.4 → 0.8.5-rc.0

package/dist-server/domain/fs/fs.service.js

@@ -1,303 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var FsService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FsService = void 0;
-const common_1 = require("@nestjs/common");
-const fs_1 = require("fs");
-const os = __importStar(require("os"));
-const nodePath = __importStar(require("path"));
-const project_repository_js_1 = require("../../repository/project.repository.js");
-let FsService = class FsService {
-    static { FsService_1 = this; }
-    projectRepo;
-    logger = new common_1.Logger(FsService_1.name);
-    /** Hard cap regardless of what caller requests. */
-    static MAX_DEPTH = 5;
-    /**
-     * Prefixes that are unconditionally blocked for security (POSIX).
-     * Checked against the resolved (real) absolute path.
-     */
-    static BLOCKED_PREFIXES = [
-        '/etc',
-        '/private',
-        '/var',
-        '/System',
-        '/usr',
-        '/bin',
-        '/sbin',
-        '/dev',
-    ];
-    /**
-     * Prefixes blocked on Windows.
-     * security_reviewer High-2: Win32 전용 BLOCKED_PREFIXES 분리.
-     */
-    static BLOCKED_PREFIXES_WIN = [
-        'C:\\Windows',
-        'C:\\Program Files',
-        'C:\\Program Files (x86)',
-        'C:\\System Volume Information',
-        'C:\\ProgramData',
-        'C:\\Recovery',
-    ];
-    constructor(projectRepo) {
-        this.projectRepo = projectRepo;
-    }
-    resolveQuickAccess() {
-        const home = os.homedir();
-        const crewxWorkspaces = nodePath.join(home, 'crewx');
-        return [
-            { key: 'home', path: home, exists: (0, fs_1.existsSync)(home) },
-            { key: 'workspaces', path: crewxWorkspaces, exists: (0, fs_1.existsSync)(crewxWorkspaces) },
-        ];
-    }
-    async getTree(rawPath, maxDepth) {
-        // 1. Reject relative paths immediately
-        if (!nodePath.isAbsolute(rawPath)) {
-            throw new common_1.BadRequestException({ code: 'PATH_NOT_ABSOLUTE', message: 'path must be absolute' });
-        }
-        // 2. Normalize (resolves .., ., and trailing slashes) without following symlinks
-        const absPath = nodePath.resolve(rawPath);
-        // 3. Reject system/protected directories
-        if (FsService_1.BLOCKED_PREFIXES.some((prefix) => absPath === prefix || absPath.startsWith(prefix + '/'))) {
-            this.logger.warn(`Blocked path access attempt: ${absPath}`);
-            throw new common_1.ForbiddenException({ code: 'PATH_BLOCKED', message: 'access to this path is not allowed' });
-        }
-        // 4. Check existence
-        if (!(0, fs_1.existsSync)(absPath)) {
-            throw new common_1.NotFoundException({ code: 'PATH_NOT_FOUND', message: 'path does not exist' });
-        }
-        // 5. Clamp depth
-        const clampedDepth = Math.min(Math.max(1, maxDepth), FsService_1.MAX_DEPTH);
-        // 6. Pre-load registered workspace paths (N+1 prevention)
-        const registeredPaths = new Set(this.projectRepo
-            .listProjects({ isActive: true, limit: 1000, offset: 0 })
-            .rows.map((r) => r.workspace_path)
-            .filter((p) => !!p));
-        // 7. Recursive walk with symlink-loop detection via visited real paths
-        return this.walk(absPath, clampedDepth, 0, registeredPaths, new Set());
-    }
-    /**
-     * Creates a new directory at parentPath/name.
-     *
-     * security_reviewer 2026-05-07 권고 반영:
-     *  - High-1: realpathSync로 symlink traversal 방어
-     *  - High-2: Win32 BLOCKED_PREFIXES 분기 + UNC path 차단
-     *  - Medium-3: name에 ':' 차단 (NTFS ADS)
-     *  - Medium-4: Windows reserved device name 차단
-     *  - Medium-5: name.trim() === '' 차단
-     *  - Info-9: 성공 시 audit log
-     */
-    async mkdir(parentPath, name) {
-        // 1. Validate parent path is absolute
-        if (!nodePath.isAbsolute(parentPath)) {
-            throw new common_1.BadRequestException({ code: 'PATH_NOT_ABSOLUTE', message: 'parentPath must be absolute' });
-        }
-        const absParent = nodePath.resolve(parentPath);
-        // High-1: resolve symlinks BEFORE blocked-prefix check (parent may be a symlink to /etc, etc.)
-        let realParent;
-        try {
-            realParent = (0, fs_1.realpathSync)(absParent);
-        }
-        catch {
-            throw new common_1.NotFoundException({ code: 'PARENT_NOT_FOUND', message: 'parent directory does not exist' });
-        }
-        // Verify the resolved parent is actually a directory (catches files on all platforms)
-        if (!(0, fs_1.statSync)(realParent).isDirectory()) {
-            throw new common_1.BadRequestException({ code: 'NOT_A_DIRECTORY', message: 'parent is not a directory' });
-        }
-        this.assertPathAllowed(realParent);
-        // 2. Validate name (defense-in-depth — DTO already validates, but server-side recheck)
-        if (name === '' || name === '.' || name === '..') {
-            throw new common_1.BadRequestException({ code: 'NAME_INVALID', message: 'name must not be empty, "." or ".."' });
-        }
-        if (name.trim() === '') {
-            // Medium-5: blank-only (spaces/tabs only)
-            throw new common_1.BadRequestException({ code: 'NAME_INVALID', message: 'name must not be blank' });
-        }
-        if (name.includes('/') || name.includes('\\') || /[\x00-\x1f]/.test(name)) {
-            throw new common_1.BadRequestException({ code: 'NAME_INVALID', message: 'name must not contain separators or control chars' });
-        }
-        if (process.platform === 'win32') {
-            if (name.includes(':')) {
-                // Medium-3: NTFS Alternate Data Streams
-                throw new common_1.BadRequestException({ code: 'NAME_INVALID', message: 'name must not contain colon on Windows' });
-            }
-            if (/^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\.|$)/i.test(name)) {
-                // Medium-4: reserved device names
-                throw new common_1.BadRequestException({ code: 'NAME_INVALID', message: 'reserved device name on Windows' });
-            }
-        }
-        // 3. Resolve target against real parent and verify containment
-        const target = nodePath.join(realParent, name);
-        if (!target.startsWith(realParent + nodePath.sep) && target !== realParent) {
-            throw new common_1.BadRequestException({ code: 'PATH_ESCAPE', message: 'resolved target escapes parent' });
-        }
-        // Re-check blocked prefixes against the resolved target
-        this.assertPathAllowed(target);
-        // 4. Attempt mkdir (NOT recursive — parent must already exist)
-        try {
-            (0, fs_1.mkdirSync)(target); // recursive not specified: ENOENT if parent missing, EEXIST if already present
-            this.logger.log(`[FS.MKDIR] created: ${target}`); // Info-9: audit log
-            return { path: target, created: true };
-        }
-        catch (err) {
-            const code = err.code;
-            if (code === 'EEXIST') {
-                // Idempotent: if it already exists AND is a directory, return created: false
-                const stat = (0, fs_1.statSync)(target);
-                if (stat.isDirectory()) {
-                    return { path: target, created: false };
-                }
-                throw new common_1.ConflictException({ code: 'NOT_A_DIRECTORY', message: 'target exists but is not a directory' });
-            }
-            if (code === 'EACCES' || code === 'EPERM') {
-                throw new common_1.ForbiddenException({ code: 'PERMISSION_DENIED', message: 'permission denied' });
-            }
-            if (code === 'ENOENT') {
-                throw new common_1.NotFoundException({ code: 'PARENT_NOT_FOUND', message: 'parent directory does not exist' });
-            }
-            if (code === 'ENOTDIR') {
-                throw new common_1.BadRequestException({ code: 'NOT_A_DIRECTORY', message: 'parent is not a directory' });
-            }
-            if (code === 'EROFS') {
-                throw new common_1.ForbiddenException({ code: 'READ_ONLY_FS', message: 'filesystem is read-only' });
-            }
-            if (code === 'ENAMETOOLONG') {
-                throw new common_1.BadRequestException({ code: 'NAME_TOO_LONG', message: 'path or name too long' });
-            }
-            this.logger.error(`mkdir failed: ${err}`);
-            throw new common_1.InternalServerErrorException({ code: 'MKDIR_FAILED', message: 'failed to create directory' });
-        }
-    }
-    /**
-     * Asserts that the given absolute path is not in a blocked system prefix.
-     * Used by both getTree and mkdir.
-     *
-     * security_reviewer High-2/High-3:
-     *  - OS-specific BLOCKED_PREFIXES (Win32 vs POSIX)
-     *  - UNC path block on Windows
-     *  - Uses nodePath.sep for correct separator per OS
-     */
-    assertPathAllowed(absPath) {
-        if (process.platform === 'win32' && absPath.startsWith('\\\\')) {
-            throw new common_1.ForbiddenException({ code: 'PATH_BLOCKED', message: 'UNC paths are not allowed' });
-        }
-        const prefixes = process.platform === 'win32' ? FsService_1.BLOCKED_PREFIXES_WIN : FsService_1.BLOCKED_PREFIXES;
-        if (prefixes.some((p) => absPath === p || absPath.startsWith(p + nodePath.sep))) {
-            this.logger.warn(`Blocked path access attempt: ${absPath}`);
-            throw new common_1.ForbiddenException({ code: 'PATH_BLOCKED', message: 'access to this path is not allowed' });
-        }
-    }
-    walk(dir, maxDepth, depth, registered, visited) {
-        if (depth >= maxDepth)
-            return [];
-        // Resolve real path to detect symlink loops
-        let realDir;
-        try {
-            realDir = (0, fs_1.realpathSync)(dir);
-        }
-        catch {
-            return []; // dangling symlink or permission error
-        }
-        if (visited.has(realDir)) {
-            this.logger.warn(`Symlink loop detected at: ${dir} → ${realDir}`);
-            return [];
-        }
-        // Clone visited set so sibling branches don't share loop state
-        const branchVisited = new Set(visited);
-        branchVisited.add(realDir);
-        let entries;
-        try {
-            entries = (0, fs_1.readdirSync)(dir, { withFileTypes: true });
-        }
-        catch {
-            return []; // permission denied or other I/O error
-        }
-        const nodes = [];
-        for (const entry of entries) {
-            // Skip hidden directories (.git, .claude, etc.)
-            if (entry.name.startsWith('.'))
-                continue;
-            // Directory picker — files are excluded
-            if (!entry.isDirectory() && !entry.isSymbolicLink())
-                continue;
-            const childPath = nodePath.join(dir, entry.name);
-            // For symlinks: resolve real path, verify it's a directory, and check for loops
-            if (entry.isSymbolicLink()) {
-                let realChild;
-                try {
-                    realChild = (0, fs_1.realpathSync)(childPath);
-                    (0, fs_1.readdirSync)(realChild, { withFileTypes: true }); // throws if not a directory
-                }
-                catch {
-                    continue; // broken symlink or target is not a directory
-                }
-                // Skip if the symlink target is already on this branch (loop prevention)
-                if (branchVisited.has(realChild)) {
-                    this.logger.warn(`Symlink loop detected at: ${childPath} → ${realChild}`);
-                    continue;
-                }
-            }
-            const hasCrewxYaml = (0, fs_1.existsSync)(nodePath.join(childPath, 'crewx.yaml')) ||
-                (0, fs_1.existsSync)(nodePath.join(childPath, 'crewx.yml'));
-            const children = this.walk(childPath, maxDepth, depth + 1, registered, branchVisited);
-            nodes.push({
-                name: entry.name,
-                path: childPath,
-                isDirectory: true,
-                children,
-                hasCrewxYaml,
-                isRegistered: registered.has(childPath),
-            });
-        }
-        // Sort alphabetically for deterministic output
-        return nodes.sort((a, b) => a.name.localeCompare(b.name));
-    }
-};
-exports.FsService = FsService;
-exports.FsService = FsService = FsService_1 = __decorate([
-    (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [project_repository_js_1.ProjectRepository])
-], FsService);

package/dist-server/domain/git/git.module.js

@@ -1,20 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GitModule = void 0;
-const common_1 = require("@nestjs/common");
-const git_service_js_1 = require("./git.service.js");
-let GitModule = class GitModule {
-};
-exports.GitModule = GitModule;
-exports.GitModule = GitModule = __decorate([
-    (0, common_1.Module)({
-        providers: [git_service_js_1.GitService],
-        exports: [git_service_js_1.GitService],
-    })
-], GitModule);

package/dist-server/domain/git/git.service.js

@@ -1,222 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var GitService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GitService = void 0;
-const common_1 = require("@nestjs/common");
-const path_1 = require("path");
-const fs = __importStar(require("fs"));
-const git = __importStar(require("isomorphic-git"));
-const workspace_context_store_js_1 = require("../../common/workspace-context.store.js");
-const AUTHOR = { name: 'CrewX', email: 'crewx@local' };
-let GitService = GitService_1 = class GitService {
-    logger = new common_1.Logger(GitService_1.name);
-    // Reuse cache object per isomorphic-git recommendation
-    cache = {};
-    get dir() {
-        return (0, workspace_context_store_js_1.getWorkspacePath)();
-    }
-    /**
-     * Stage a file and create a commit. Returns the commit SHA.
-     */
-    async commitFile(filepath, message) {
-        await git.add({ fs, dir: this.dir, filepath, cache: this.cache });
-        const sha = await git.commit({
-            fs,
-            dir: this.dir,
-            message,
-            author: AUTHOR,
-            cache: this.cache,
-        });
-        return sha;
-    }
-    /**
-     * Return commit history, optionally filtered by filepath.
-     */
-    async getHistory(filepath, depth = 50) {
-        const commits = await git.log({
-            fs,
-            dir: this.dir,
-            depth,
-            filepath,
-            cache: this.cache,
-        });
-        return commits.map((c) => ({
-            sha: c.oid,
-            message: c.commit.message.trim(),
-            timestamp: c.commit.committer.timestamp * 1000,
-            author: c.commit.author.name,
-        }));
-    }
-    /**
-     * Restore a file to its state at the given commit SHA.
-     */
-    async rollbackFile(filepath, commitSha) {
-        // Read file blob at that commit
-        const { blob } = await git.readBlob({
-            fs,
-            dir: this.dir,
-            oid: commitSha,
-            filepath,
-            cache: this.cache,
-        });
-        const absPath = (0, path_1.join)(this.dir, filepath);
-        fs.writeFileSync(absPath, Buffer.from(blob));
-        // Commit the rollback
-        await this.commitFile(filepath, `revert: restore ${filepath} to ${commitSha.slice(0, 7)}`);
-    }
-    /**
-     * Return diff entries for the given commit compared to its parent.
-     * If filepath is provided, only include that file.
-     */
-    async getFileDiff(commitSha, filepath) {
-        const commits = await git.log({
-            fs,
-            dir: this.dir,
-            depth: 2,
-            ref: commitSha,
-            cache: this.cache,
-        });
-        const currentCommit = commits[0];
-        const parentCommit = commits[1];
-        if (!currentCommit)
-            return [];
-        const currentTree = currentCommit.commit.tree;
-        const parentTree = parentCommit?.commit.tree;
-        const results = [];
-        const walkerTrees = parentTree
-            ? [git.TREE({ ref: parentTree }), git.TREE({ ref: currentTree })]
-            : [git.TREE({ ref: currentTree })];
-        const changes = await git.walk({
-            fs,
-            dir: this.dir,
-            trees: walkerTrees,
-            map: async (path, entries) => {
-                if (filepath && path !== filepath)
-                    return null;
-                // When no parent: single walker entry means all files are "add"
-                if (!parentTree) {
-                    const [current] = entries;
-                    if (!current)
-                        return null;
-                    const entryType = await current.type();
-                    if (entryType === 'tree')
-                        return null;
-                    const oid = await current.oid();
-                    let afterContent;
-                    try {
-                        const { blob } = await git.readBlob({
-                            fs,
-                            dir: this.dir,
-                            oid,
-                            cache: this.cache,
-                        });
-                        afterContent = Buffer.from(blob).toString('utf-8');
-                    }
-                    catch (e) {
-                        this.logger.warn(`Failed to read blob for ${path}: ${e}`);
-                    }
-                    return { filepath: path, type: 'add', after: afterContent };
-                }
-                const [before, after] = entries;
-                const beforeType = await before?.type();
-                const afterType = await after?.type();
-                // Skip directories
-                if (beforeType === 'tree' || afterType === 'tree')
-                    return null;
-                const beforeOid = await before?.oid();
-                const afterOid = await after?.oid();
-                if (beforeOid === afterOid)
-                    return null; // No change
-                let type;
-                if (!before || beforeType === undefined) {
-                    type = 'add';
-                }
-                else if (!after || afterType === undefined) {
-                    type = 'delete';
-                }
-                else {
-                    type = 'modify';
-                }
-                let beforeContent;
-                let afterContent;
-                try {
-                    if (type !== 'add' && beforeOid) {
-                        const { blob } = await git.readBlob({
-                            fs,
-                            dir: this.dir,
-                            oid: beforeOid,
-                            cache: this.cache,
-                        });
-                        beforeContent = Buffer.from(blob).toString('utf-8');
-                    }
-                    if (type !== 'delete' && afterOid) {
-                        const { blob } = await git.readBlob({
-                            fs,
-                            dir: this.dir,
-                            oid: afterOid,
-                            cache: this.cache,
-                        });
-                        afterContent = Buffer.from(blob).toString('utf-8');
-                    }
-                }
-                catch (e) {
-                    this.logger.warn(`Failed to read blob for ${path}: ${e}`);
-                }
-                return {
-                    filepath: path,
-                    type,
-                    before: beforeContent,
-                    after: afterContent,
-                };
-            },
-        });
-        for (const entry of changes) {
-            if (entry)
-                results.push(entry);
-        }
-        return results;
-    }
-};
-exports.GitService = GitService;
-exports.GitService = GitService = GitService_1 = __decorate([
-    (0, common_1.Injectable)()
-], GitService);

package/dist-server/domain/health/health.controller.js

@@ -1,57 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HealthController = void 0;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const common_1 = require("@nestjs/common");
-const swagger_1 = require("@nestjs/swagger");
-const sdk_1 = require("@crewx/sdk");
-const public_decorator_js_1 = require("../auth/decorators/public.decorator.js");
-// Walk up from __dirname to find root package.json (works in both src/ and dist-server/ layouts)
-const PKG_VERSION = (() => {
-    let dir = __dirname;
-    while (dir !== (0, node_path_1.dirname)(dir)) {
-        try {
-            const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, 'package.json'), 'utf-8'));
-            if (pkg.name === 'crewx')
-                return pkg.version;
-        }
-        catch { }
-        dir = (0, node_path_1.dirname)(dir);
-    }
-    return 'unknown';
-})();
-let HealthController = class HealthController {
-    startedAt = Date.now();
-    health() {
-        const raw = process.env.CREWX_WORKSPACE || process.cwd();
-        const workspace = (0, sdk_1.normalizeWorkspacePath)(raw);
-        const uptime = Math.floor((Date.now() - this.startedAt) / 1000);
-        return {
-            success: true,
-            data: { status: 'ok', version: PKG_VERSION, workspace, uptime },
-        };
-    }
-};
-exports.HealthController = HealthController;
-__decorate([
-    (0, swagger_1.ApiOperation)({ operationId: 'SYS.HEALTH', summary: 'Server health check' }),
-    (0, common_1.Get)(),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", []),
-    __metadata("design:returntype", void 0)
-], HealthController.prototype, "health", null);
-exports.HealthController = HealthController = __decorate([
-    (0, public_decorator_js_1.Public)(),
-    (0, swagger_1.ApiTags)('health'),
-    (0, common_1.Controller)('health')
-], HealthController);

package/dist-server/domain/health/health.module.js

@@ -1,19 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HealthModule = void 0;
-const common_1 = require("@nestjs/common");
-const health_controller_js_1 = require("./health.controller.js");
-let HealthModule = class HealthModule {
-};
-exports.HealthModule = HealthModule;
-exports.HealthModule = HealthModule = __decorate([
-    (0, common_1.Module)({
-        controllers: [health_controller_js_1.HealthController],
-    })
-], HealthModule);

package/dist-server/domain/knowledge/dto/graph-knowledge.dto.js

@@ -1,27 +0,0 @@
-"use strict";
-/**
- * DTOs for KNW.GRAPH Knowledge Graph API
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GraphKnowledgeDto = void 0;
-const swagger_1 = require("@nestjs/swagger");
-const class_validator_1 = require("class-validator");
-class GraphKnowledgeDto {
-    agent;
-}
-exports.GraphKnowledgeDto = GraphKnowledgeDto;
-__decorate([
-    (0, swagger_1.ApiPropertyOptional)({ description: 'Filter by agent' }),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
-    __metadata("design:type", String)
-], GraphKnowledgeDto.prototype, "agent", void 0);