cto-ai-cli 5.0.0 → 5.2.0

package/dist/api/server.js

@@ -592,8 +592,8 @@ async function analyzeProject(projectPath, config) {
     maxDepth: mergedConfig.analysis.maxDepth
   });
   const tokenMethod = mergedConfig.tokens.method;
-  const files = [];
-  for (const entry of walkEntries) {
+  const BATCH_SIZE = 50;
+  async function estimateFileTokens(entry) {
     let tokens;
     if (tokenMethod === "tiktoken") {
       try {
@@ -605,7 +605,7 @@ async function analyzeProject(projectPath, config) {
     } else {
       tokens = countTokensChars4(entry.size);
     }
-    files.push({
+    return {
       path: entry.path,
       relativePath: entry.relativePath,
       extension: entry.extension,
@@ -614,16 +614,20 @@ async function analyzeProject(projectPath, config) {
       lines: entry.lines,
       lastModified: entry.lastModified,
       kind: classifyFileKind(entry.relativePath),
-      // Graph data — populated by graph analysis
       imports: [],
       importedBy: [],
       isHub: false,
       complexity: 0,
-      // Risk data — populated by risk analysis
       riskScore: 0,
       riskFactors: [],
       exclusionImpact: "none"
-    });
+    };
+  }
+  const files = [];
+  for (let i = 0; i < walkEntries.length; i += BATCH_SIZE) {
+    const batch = walkEntries.slice(i, i + BATCH_SIZE);
+    const results = await Promise.all(batch.map(estimateFileTokens));
+    files.push(...results);
   }
   const graph = buildProjectGraph(absPath, files);
   for (const file of files) {
@@ -3226,6 +3230,52 @@ async function planInteraction(input) {
 // src/api/server.ts
 var API_VERSION = "1.0.0";
 var DEFAULT_PORT = 3141;
+var FORBIDDEN_PREFIXES = [
+  "/etc",
+  "/usr",
+  "/var",
+  "/sys",
+  "/proc",
+  "/dev",
+  "/boot",
+  "/sbin",
+  "/bin",
+  "/tmp",
+  "/root",
+  "/lib",
+  "/opt"
+];
+var FORBIDDEN_PATTERNS = [".ssh", ".gnupg", ".aws", ".env", "passwd", "shadow"];
+function getAllowedRoots() {
+  const raw = process.env.CTO_ALLOWED_ROOTS;
+  if (!raw) return null;
+  return raw.split(",").map((r) => resolve7(r.trim()));
+}
+function validateProjectPath(projectPath) {
+  if (typeof projectPath !== "string" || !projectPath.trim()) {
+    return { valid: false, reason: "Missing or invalid path field" };
+  }
+  const absPath = resolve7(projectPath);
+  const lower = absPath.toLowerCase();
+  for (const prefix of FORBIDDEN_PREFIXES) {
+    if (lower === prefix || lower.startsWith(prefix + "/")) {
+      return { valid: false, reason: `Access denied: system path ${prefix}` };
+    }
+  }
+  for (const pattern of FORBIDDEN_PATTERNS) {
+    if (lower.includes(pattern)) {
+      return { valid: false, reason: `Access denied: path contains forbidden segment '${pattern}'` };
+    }
+  }
+  const roots = getAllowedRoots();
+  if (roots && roots.length > 0) {
+    const allowed = roots.some((root) => absPath === root || absPath.startsWith(root + "/"));
+    if (!allowed) {
+      return { valid: false, reason: `Access denied: path not under allowed roots. Set CTO_ALLOWED_ROOTS to allow.` };
+    }
+  }
+  return { valid: true, absPath };
+}
 function validateApiKey(req) {
   const apiKey = process.env.CTO_API_KEY;
   if (!apiKey) return true;
@@ -3287,9 +3337,9 @@ function error(res, status, message) {
   json(res, status, { error: message, status });
 }
 async function handleAnalyze(body, res) {
-  const { path: projectPath } = body;
-  if (!projectPath) return error(res, 400, "Missing required field: path");
-  const absPath = resolve7(projectPath);
+  const check = validateProjectPath(body.path);
+  if (!check.valid) return error(res, 403, check.reason);
+  const absPath = check.absPath;
   const analysis = await getCachedAnalysis(absPath);
   json(res, 200, {
     project: analysis.projectName,
@@ -3307,10 +3357,11 @@ async function handleAnalyze(body, res) {
   });
 }
 async function handleSelect(body, res) {
-  const { path: projectPath, task, budget } = body;
-  if (!projectPath) return error(res, 400, "Missing required field: path");
+  const { task, budget } = body;
+  const check = validateProjectPath(body.path);
+  if (!check.valid) return error(res, 403, check.reason);
   if (!task) return error(res, 400, "Missing required field: task");
-  const absPath = resolve7(projectPath);
+  const absPath = check.absPath;
   const analysis = await getCachedAnalysis(absPath);
   const selection = await selectContext({
     task,
@@ -3334,9 +3385,10 @@ async function handleSelect(body, res) {
   });
 }
 async function handleScore(body, res) {
-  const { path: projectPath, task, budget } = body;
-  if (!projectPath) return error(res, 400, "Missing required field: path");
-  const absPath = resolve7(projectPath);
+  const { task, budget } = body;
+  const check = validateProjectPath(body.path);
+  if (!check.valid) return error(res, 403, check.reason);
+  const absPath = check.absPath;
   const analysis = await getCachedAnalysis(absPath);
   const score = await computeContextScore(
     analysis,
@@ -3359,9 +3411,10 @@ async function handleScore(body, res) {
   });
 }
 async function handleBenchmark(body, res) {
-  const { path: projectPath, task, budget } = body;
-  if (!projectPath) return error(res, 400, "Missing required field: path");
-  const absPath = resolve7(projectPath);
+  const { task, budget } = body;
+  const check = validateProjectPath(body.path);
+  if (!check.valid) return error(res, 403, check.reason);
+  const absPath = check.absPath;
   const analysis = await getCachedAnalysis(absPath);
   const result = await runBenchmark(
     analysis,
@@ -3371,10 +3424,11 @@ async function handleBenchmark(body, res) {
   json(res, 200, result);
 }
 async function handleQuality(body, res) {
-  const { path: projectPath, task, budget } = body;
-  if (!projectPath) return error(res, 400, "Missing required field: path");
+  const { task, budget } = body;
+  const check = validateProjectPath(body.path);
+  if (!check.valid) return error(res, 403, check.reason);
   if (!task) return error(res, 400, "Missing required field: task");
-  const absPath = resolve7(projectPath);
+  const absPath = check.absPath;
   const analysis = await getCachedAnalysis(absPath);
   const result = await runQualityBenchmark(analysis, task, budget ?? 5e4);
   json(res, 200, {
@@ -3388,9 +3442,10 @@ async function handleQuality(body, res) {
   });
 }
 async function handlePRContext(body, res) {
-  const { path: projectPath, baseBranch, depth, includeTests } = body;
-  if (!projectPath) return error(res, 400, "Missing required field: path");
-  const absPath = resolve7(projectPath);
+  const { baseBranch, depth, includeTests } = body;
+  const check = validateProjectPath(body.path);
+  if (!check.valid) return error(res, 403, check.reason);
+  const absPath = check.absPath;
   const analysis = await getCachedAnalysis(absPath);
   const pr = await generatePRContext(analysis, {
     baseBranch: baseBranch ?? "main",
@@ -3409,10 +3464,11 @@ async function handlePRContext(body, res) {
   });
 }
 async function handleInteract(body, res) {
-  const { path: projectPath, task, budget, model } = body;
-  if (!projectPath) return error(res, 400, "Missing required field: path");
+  const { task, budget, model } = body;
+  const check = validateProjectPath(body.path);
+  if (!check.valid) return error(res, 403, check.reason);
   if (!task) return error(res, 400, "Missing required field: task");
-  const absPath = resolve7(projectPath);
+  const absPath = check.absPath;
   const analysis = await getCachedAnalysis(absPath);
   const plan = await planInteraction({
     task,
@@ -3568,8 +3624,9 @@ function createAPIServer() {
       const body = req.method === "GET" ? {} : await readBody(req);
       await handler(body, res);
     } catch (err) {
-      console.error(`[CTO API] Error on ${routeKey}:`, err.message);
-      error(res, 500, err.message ?? "Internal server error");
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[CTO API] Error on ${routeKey}:`, message);
+      error(res, 500, message || "Internal server error");
     }
   });
   return server2;