ctxpool 0.1.0 → 0.4.0

package/dist/ui.js

@@ -1,273 +1,239 @@
 import { createServer } from "node:http";
-import { createReadStream, existsSync, readFileSync, statSync } from "node:fs";
+import { createReadStream, existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { networkInterfaces } from "node:os";
 import { spawnSync } from "node:child_process";
 import { dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildAgentContext, buildTeamTimelineExport, createContextPack, deriveContextBlocks, renderContextPackOutput } from "./handoff.js";
+import { buildAgentContext, buildTeamTimelineExport, deriveContextBlocks } from "./handoff.js";
+import { createContextPack, renderContextPackOutput } from "./pack.js";
+import { redactSecrets } from "./redact.js";
 import { openStore } from "./store.js";
+import { CtxError } from "./util.js";
 const MAX_FILE_VIEW_BYTES = 512 * 1024;
-const MAX_JSON_BODY_BYTES = 1024 * 1024;
+const MAX_JSON_BODY_BYTES = 2 * 1024 * 1024;
+const LOOPBACK = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
 export function isValidContextPackBody(body) {
     return Boolean(parseContextPackBody(body));
 }
 export async function startUi(options = {}) {
     const host = options.host || "127.0.0.1";
     const requestedPort = options.port ?? 4377;
-    const ports = options.port ? [requestedPort] : Array.from({ length: 11 }, (_, index) => requestedPort + index);
+    const ports = options.fallback === false ? [requestedPort] : Array.from({ length: 11 }, (_, index) => requestedPort + index);
+    const allowedHosts = allowedHostnames(host);
     for (const port of ports) {
-        const server = createUiServer();
+        const server = createServer((req, res) => {
+            handle(req, res, allowedHosts).catch((error) => {
+                const status = error instanceof HttpError ? error.status : 500;
+                if (!res.headersSent)
+                    sendJson(res, status, { error: error instanceof Error ? error.message : "Unknown error" });
+                else
+                    res.end();
+            });
+        });
         const result = await listen(server, host, port);
         if (result.ok) {
-            console.log(`ContextPool UI running at http://${host}:${port}`);
-            return;
+            const address = server.address();
+            const boundPort = typeof address === "object" && address ? address.port : port;
+            const displayHost = host.includes(":") ? `[${host}]` : host;
+            return { url: `http://${displayHost}:${boundPort}`, host, port: boundPort, close: () => closeServer(server) };
         }
-        server.close();
-        if (options.port || result.code !== "EADDRINUSE") {
-            throw new Error(`Unable to start ContextPool UI on ${host}:${port}: ${result.code}`);
+        if (result.code !== "EADDRINUSE" || ports.length === 1) {
+            throw new CtxError(`Could not start the UI on ${host}:${port} (${result.code}).`, result.code === "EADDRINUSE" ? "Pick another port with --port." : undefined);
         }
     }
-    throw new Error(`Unable to start ContextPool UI. Ports ${ports[0]}-${ports[ports.length - 1]} are already in use.`);
-}
-function createUiServer() {
-    return createServer(async (req, res) => {
-        try {
-            await route(req, res);
-        }
-        catch (error) {
-            sendJson(res, 500, { error: error instanceof Error ? error.message : "Unknown error" });
-        }
-    });
+    throw new CtxError(`Ports ${ports[0]}–${ports[ports.length - 1]} are all in use.`, "Pick another port with --port.");
 }
 function listen(server, host, port) {
-    return new Promise((resolve) => {
-        server.once("error", (error) => {
-            resolve({ ok: false, code: error.code || error.message });
-        });
+    return new Promise((resolvePromise) => {
+        server.once("error", (error) => resolvePromise({ ok: false, code: error.code || error.message }));
         server.listen(port, host, () => {
             server.removeAllListeners("error");
-            resolve({ ok: true });
+            resolvePromise({ ok: true });
         });
     });
 }
-async function route(req, res) {
-    const url = new URL(req.url || "/", "http://127.0.0.1");
+function closeServer(server) {
+    return new Promise((resolvePromise) => {
+        server.closeAllConnections?.();
+        server.close(() => resolvePromise());
+    });
+}
+// ---------------------------------------------------------------------------
+// Routing
+async function handle(req, res, allowedHosts) {
+    setSecurityHeaders(res);
+    const url = new URL(req.url || "/", "http://localhost");
     const method = req.method || "GET";
-    if (isMutatingMethod(method) && !isLocalRequest(req)) {
-        return sendJson(res, 403, { error: "ContextPool UI only accepts local mutating requests" });
+    // Reject requests addressed to any other hostname. This blocks DNS-rebinding pages from reading local data.
+    if (!isAllowedRequest(req, allowedHosts))
+        return sendJson(res, 403, { error: "Forbidden host or origin" });
+    if (isMutatingMethod(method) && !isJsonRequest(req))
+        return sendJson(res, 415, { error: "Use Content-Type: application/json" });
+    const path = url.pathname;
+    const param = (prefix, suffix = "") => decodeURIComponent(path.slice(prefix.length, suffix ? -suffix.length : undefined));
+    if (path === "/api/tasks")
+        return withStore((store) => sendJson(res, 200, { tasks: store.listTasks() }));
+    if (path === "/api/handoffs") {
+        return withStore((store) => sendJson(res, 200, { handoffs: store.listHandoffPackets(url.searchParams.get("task") || undefined) }));
     }
-    if (url.pathname === "/api/tasks") {
-        const store = await openStore();
-        try {
-            return sendJson(res, 200, { tasks: store.listTasks() });
-        }
-        finally {
-            store.close();
-        }
-    }
-    if (url.pathname === "/api/handoffs") {
-        const store = await openStore();
-        try {
-            return sendJson(res, 200, { handoffs: store.listHandoffPackets(url.searchParams.get("task") || undefined) });
-        }
-        finally {
-            store.close();
-        }
-    }
-    if (url.pathname === "/api/context-blocks") {
-        const task = url.searchParams.get("task") || undefined;
-        const store = await openStore();
-        try {
-            const handoffs = store.listHandoffPackets(task);
-            const blocks = handoffs.flatMap(deriveContextBlocks);
-            return sendJson(res, 200, { blocks });
-        }
-        finally {
-            store.close();
-        }
+    if (path === "/api/context-blocks") {
+        return withStore((store) => sendJson(res, 200, { blocks: store.listHandoffPackets(url.searchParams.get("task") || undefined).flatMap(deriveContextBlocks) }));
     }
-    if (url.pathname === "/api/context-packs") {
-        const store = await openStore();
-        try {
-            if (req.method === "GET")
-                return sendJson(res, 200, { packs: store.listContextPacks() });
-            if (req.method !== "POST")
-                return sendJson(res, 405, { error: "Use GET or POST" });
-            const body = await readJsonBody(req);
-            const name = typeof body.name === "string" ? body.name : "Untitled context pack";
-            const blocks = Array.isArray(body.blocks) ? body.blocks : [];
-            const includeRawTranscript = body.includeRawTranscript === true;
-            const explicitPack = parseContextPackBody(body);
-            const pack = explicitPack || createContextPack(name, blocks, { includeRawTranscript });
-            return sendJson(res, 200, { pack: store.saveContextPack({ ...pack, updatedAt: new Date().toISOString() }) });
-        }
-        finally {
-            store.close();
-        }
+    if (path === "/api/context-packs") {
+        if (method === "GET")
+            return withStore((store) => sendJson(res, 200, { packs: store.listContextPacks() }));
+        if (method !== "POST")
+            return sendJson(res, 405, { error: "Use GET or POST" });
+        const body = await readJsonBody(req);
+        const explicit = parseContextPackBody(body);
+        if (!explicit && Array.isArray(body.blocks) && !body.blocks.every(isContextBlock))
+            return sendJson(res, 400, { error: "Invalid context blocks" });
+        const pack = explicit ||
+            createContextPack(typeof body.name === "string" ? body.name : "Untitled pack", Array.isArray(body.blocks) ? body.blocks : [], {
+                includeRawTranscript: body.includeRawTranscript === true
+            });
+        return withStore((store) => sendJson(res, 200, { pack: store.saveContextPack({ ...pack, updatedAt: new Date().toISOString() }) }));
     }
-    if (url.pathname.startsWith("/api/context-packs/") && url.pathname.endsWith("/export")) {
-        const id = decodeURIComponent(url.pathname.replace("/api/context-packs/", "").replace("/export", ""));
-        if (!id)
-            return sendJson(res, 400, { error: "Missing context pack id" });
-        const store = await openStore();
-        try {
+    if (path.startsWith("/api/context-packs/") && path.endsWith("/export")) {
+        const id = param("/api/context-packs/", "/export");
+        return withStore((store) => {
             const pack = store.getContextPackById(id);
             if (!pack)
                 return sendJson(res, 404, { error: "Context pack not found" });
             const output = renderContextPackOutput(pack);
             return url.searchParams.get("format") === "markdown" ? sendText(res, output.markdown) : sendJson(res, 200, output);
-        }
-        finally {
-            store.close();
-        }
+        });
     }
-    if (url.pathname.startsWith("/api/context-packs/")) {
-        const id = decodeURIComponent(url.pathname.replace("/api/context-packs/", ""));
-        if (!id)
-            return sendJson(res, 400, { error: "Missing context pack id" });
-        const store = await openStore();
-        try {
-            if (req.method === "GET") {
+    if (path.startsWith("/api/context-packs/")) {
+        const id = param("/api/context-packs/");
+        if (method === "GET") {
+            return withStore((store) => {
                 const pack = store.getContextPackById(id);
                 return sendJson(res, pack ? 200 : 404, pack ? { pack } : { error: "Context pack not found" });
-            }
-            if (req.method === "DELETE") {
-                return sendJson(res, store.deleteContextPack(id) ? 200 : 404, { ok: true });
-            }
-            if (req.method !== "PUT")
-                return sendJson(res, 405, { error: "Use GET, PUT, or DELETE" });
-            const body = await readJsonBody(req);
-            const pack = parseContextPackBody(body);
-            if (!pack || pack.id !== id)
-                return sendJson(res, 400, { error: "Invalid context pack body" });
-            return sendJson(res, 200, { pack: store.saveContextPack({ ...pack, updatedAt: new Date().toISOString() }) });
-        }
-        finally {
-            store.close();
+            });
         }
+        if (method === "DELETE")
+            return withStore((store) => (store.deleteContextPack(id) ? sendJson(res, 200, { ok: true }) : sendJson(res, 404, { error: "Context pack not found" })));
+        if (method !== "PUT")
+            return sendJson(res, 405, { error: "Use GET, PUT, or DELETE" });
+        const pack = parseContextPackBody(await readJsonBody(req));
+        if (!pack || pack.id !== id)
+            return sendJson(res, 400, { error: "Invalid context pack body" });
+        return withStore((store) => sendJson(res, 200, { pack: store.saveContextPack({ ...pack, updatedAt: new Date().toISOString() }) }));
     }
-    if (url.pathname.startsWith("/api/handoffs/") && url.pathname.endsWith("/agent-context")) {
-        const id = decodeURIComponent(url.pathname.replace("/api/handoffs/", "").replace("/agent-context", ""));
-        if (!id)
-            return sendJson(res, 400, { error: "Missing handoff id" });
-        const store = await openStore();
-        try {
+    if (path.startsWith("/api/handoffs/") && path.endsWith("/agent-context")) {
+        const id = param("/api/handoffs/", "/agent-context");
+        return withStore((store) => {
             const handoff = store.getHandoffById(id);
             if (!handoff)
                 return sendJson(res, 404, { error: "Handoff not found" });
             const context = buildAgentContext(handoff);
             return url.searchParams.get("format") === "json" ? sendJson(res, 200, context) : sendText(res, context.markdown);
-        }
-        finally {
-            store.close();
-        }
+        });
     }
-    if (url.pathname.startsWith("/api/handoffs/") && url.pathname.endsWith("/team-export")) {
-        const id = decodeURIComponent(url.pathname.replace("/api/handoffs/", "").replace("/team-export", ""));
-        if (!id)
-            return sendJson(res, 400, { error: "Missing handoff id" });
-        const store = await openStore();
-        try {
+    if (path.startsWith("/api/handoffs/") && path.endsWith("/team-export")) {
+        const id = param("/api/handoffs/", "/team-export");
+        return withStore((store) => {
             const handoff = store.getHandoffById(id);
             if (!handoff)
                 return sendJson(res, 404, { error: "Handoff not found" });
-            const includeRawTranscript = url.searchParams.get("includeRawTranscript") === "true";
-            return sendJson(res, 200, buildTeamTimelineExport(handoff, { includeRawTranscript }));
-        }
-        finally {
-            store.close();
-        }
+            return sendJson(res, 200, buildTeamTimelineExport(handoff, { includeRawTranscript: url.searchParams.get("includeRawTranscript") === "true" }));
+        });
     }
-    if (url.pathname.startsWith("/api/handoffs/")) {
-        const id = decodeURIComponent(url.pathname.replace("/api/handoffs/", ""));
-        if (!id)
-            return sendJson(res, 400, { error: "Missing handoff id" });
-        const store = await openStore();
-        try {
+    if (path.startsWith("/api/handoffs/")) {
+        const id = param("/api/handoffs/");
+        return withStore((store) => {
             const handoff = store.getHandoffById(id);
             return sendJson(res, handoff ? 200 : 404, handoff ? { handoff } : { error: "Handoff not found" });
-        }
-        finally {
-            store.close();
-        }
+        });
     }
-    if (url.pathname === "/api/latest") {
-        const store = await openStore();
-        try {
+    if (path === "/api/latest") {
+        return withStore((store) => {
             const handoff = store.getLatestHandoff(url.searchParams.get("task") || undefined);
             return sendJson(res, handoff ? 200 : 404, handoff ? { handoff } : { error: "No handoff found" });
-        }
-        finally {
-            store.close();
-        }
+        });
     }
-    if (url.pathname === "/api/files/view") {
-        if (req.method !== "GET")
+    if (path === "/api/files/view") {
+        if (method !== "GET")
             return sendJson(res, 405, { ok: false, error: "Use GET" });
         const repoPath = url.searchParams.get("repoPath") || "";
-        const filePath = url.searchParams.get("path") || "";
         if (!(await isKnownRepoPath(repoPath)))
-            return sendJson(res, 403, { ok: false, error: "Repository path is not in saved handoffs" });
-        const result = readRepoFileForView(repoPath, filePath);
+            return sendJson(res, 403, { ok: false, error: "Repository is not in any saved handoff" });
+        const result = readRepoFileForView(repoPath, url.searchParams.get("path") || "");
         return sendJson(res, result.ok ? 200 : fileViewStatus(result.error), result);
     }
-    if (url.pathname === "/api/files/open") {
-        if (req.method !== "POST")
+    if (path === "/api/files/open") {
+        if (method !== "POST")
             return sendJson(res, 405, { error: "Use POST" });
         const body = await readJsonBody(req);
         const repoPath = typeof body.repoPath === "string" ? body.repoPath : "";
-        const filePath = typeof body.path === "string" ? body.path : "";
-        const line = typeof body.line === "number" ? body.line : undefined;
-        const mode = body.mode === "reveal" ? "reveal" : "open";
         if (!(await isKnownRepoPath(repoPath)))
-            return sendJson(res, 403, { ok: false, error: "Repository path is not in saved handoffs" });
-        const safe = resolveSafeRepoPath(repoPath, filePath);
+            return sendJson(res, 403, { ok: false, error: "Repository is not in any saved handoff" });
+        const safe = resolveSafeRepoPath(repoPath, typeof body.path === "string" ? body.path : "");
         if (!safe.ok)
             return sendJson(res, 400, { ok: false, error: safe.error });
         if (!existsSync(safe.path))
             return sendJson(res, 404, { ok: false, error: "File does not exist on disk" });
-        return sendJson(res, 200, openLocalFile(safe.path, line, mode));
+        const line = typeof body.line === "number" && Number.isInteger(body.line) && body.line > 0 ? body.line : undefined;
+        return sendJson(res, 200, openLocalFile(safe.path, line, body.mode === "reveal" ? "reveal" : "open"));
     }
-    if (trySendStaticAsset(url.pathname, res))
+    if (path.startsWith("/api/"))
+        return sendJson(res, 404, { error: "Not found" });
+    if (method !== "GET" && method !== "HEAD")
+        return sendJson(res, 405, { error: "Use GET" });
+    if (trySendStaticAsset(path, res))
         return;
-    if (url.pathname === "/" || isHandoffPage(url.pathname))
-        return sendWebApp(res);
-    sendJson(res, 404, { error: "Not found" });
-}
-function isHandoffPage(pathname) {
-    const parts = pathname.split("/").filter(Boolean);
-    return parts.length === 2 && parts[0] === "handoffs" && parts[1].length > 0;
-}
-function sendJson(res, status, data) {
-    res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
-    res.end(JSON.stringify(data, null, 2));
-}
-function sendText(res, text) {
-    res.writeHead(200, { "content-type": "text/plain; charset=utf-8" });
-    res.end(text);
+    return sendWebApp(res);
 }
-function sendHtml(res, html) {
-    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-    res.end(html);
+async function withStore(fn) {
+    const store = await openStore();
+    try {
+        fn(store);
+    }
+    finally {
+        store.close();
+    }
 }
-function isMutatingMethod(method) {
-    return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+// ---------------------------------------------------------------------------
+// Request guards
+function allowedHostnames(boundHost) {
+    const hosts = new Set(LOOPBACK);
+    if (boundHost === "0.0.0.0" || boundHost === "::") {
+        for (const addresses of Object.values(networkInterfaces()))
+            for (const address of addresses || [])
+                hosts.add(address.address);
+    }
+    else {
+        hosts.add(boundHost);
+    }
+    return hosts;
 }
 export function isLocalRequest(req) {
-    const host = normalizeHost(req.headers.host);
-    const origin = typeof req.headers.origin === "string" ? req.headers.origin : "";
-    if (!host || !isLocalHostname(host.hostname))
+    return isAllowedRequest(req, LOOPBACK);
+}
+function isAllowedRequest(req, allowed) {
+    const host = parseHost(req.headers.host);
+    if (!host || !allowed.has(host.hostname))
         return false;
+    const origin = typeof req.headers.origin === "string" ? req.headers.origin : "";
     if (!origin)
         return true;
     try {
         const parsed = new URL(origin);
-        return isLocalHostname(parsed.hostname) && (!parsed.port || !host.port || parsed.port === host.port);
+        return allowed.has(parsed.hostname) && (parsed.port || "80") === (host.port || "80");
     }
     catch {
         return false;
     }
 }
-function normalizeHost(value) {
+function parseHost(value) {
     const raw = Array.isArray(value) ? value[0] : value;
     if (!raw)
         return undefined;
@@ -279,8 +245,13 @@ function normalizeHost(value) {
         return undefined;
     }
 }
-function isLocalHostname(hostname) {
-    return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
+function isMutatingMethod(method) {
+    return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+}
+function isJsonRequest(req) {
+    if (req.method === "DELETE")
+        return true;
+    return /^application\/json\b/i.test(req.headers["content-type"] || "");
 }
 async function isKnownRepoPath(repoPath) {
     if (!repoPath)
@@ -288,95 +259,12 @@ async function isKnownRepoPath(repoPath) {
     const requested = resolve(repoPath);
     const store = await openStore();
     try {
-        return store.listHandoffPackets().some((handoff) => resolve(handoff.repo.repoPath) === requested);
+        return store.listRepoPaths().some((path) => resolve(path) === requested);
     }
     finally {
         store.close();
     }
 }
-function sendWebApp(res) {
-    const indexPath = join(webDistDir(), "index.html");
-    if (existsSync(indexPath))
-        return sendHtml(res, readFileSync(indexPath, "utf8"));
-    return sendHtml(res, `<!doctype html><html><head><title>ContextPool</title><style>body{font-family:ui-sans-serif,system-ui;margin:40px;color:#09090b}code{background:#f4f4f5;padding:2px 4px;border-radius:4px}</style></head><body><h1>ContextPool UI assets are not built</h1><p>Run <code>npm run build:web</code> or <code>npm run build</code>, then restart <code>ctxpool ui</code>.</p></body></html>`);
-}
-function trySendStaticAsset(pathname, res) {
-    const extension = extname(pathname);
-    if (!extension)
-        return false;
-    const root = webDistDir();
-    const requested = resolve(root, `.${decodeURIComponent(pathname)}`);
-    const rel = relative(root, requested);
-    if (rel.startsWith("..") || isAbsolute(rel) || !existsSync(requested))
-        return false;
-    const stats = statSync(requested);
-    if (!stats.isFile())
-        return false;
-    res.writeHead(200, { "content-type": contentType(extension) });
-    createReadStream(requested).pipe(res);
-    return true;
-}
-function webDistDir() {
-    const moduleDir = dirname(fileURLToPath(import.meta.url));
-    return resolve(moduleDir, "..", "dist-web");
-}
-function contentType(extension) {
-    switch (extension) {
-        case ".html":
-            return "text/html; charset=utf-8";
-        case ".js":
-            return "text/javascript; charset=utf-8";
-        case ".css":
-            return "text/css; charset=utf-8";
-        case ".svg":
-            return "image/svg+xml";
-        case ".png":
-            return "image/png";
-        case ".jpg":
-        case ".jpeg":
-            return "image/jpeg";
-        case ".webp":
-            return "image/webp";
-        default:
-            return "application/octet-stream";
-    }
-}
-export function readRepoFileForView(repoPath, filePath) {
-    const safe = resolveSafeRepoPath(repoPath, filePath);
-    if (!safe.ok)
-        return { ok: false, error: safe.error };
-    if (!existsSync(safe.path))
-        return { ok: false, path: filePath, error: "File does not exist on disk" };
-    const stats = statSync(safe.path);
-    if (!stats.isFile())
-        return { ok: false, path: filePath, error: "Path is not a file" };
-    if (stats.size > MAX_FILE_VIEW_BYTES) {
-        return { ok: false, path: filePath, size: stats.size, error: `File is larger than ${MAX_FILE_VIEW_BYTES} bytes` };
-    }
-    const buffer = readFileSync(safe.path);
-    if (isBinaryFile(filePath, buffer))
-        return { ok: false, path: filePath, size: stats.size, error: "Binary files cannot be previewed" };
-    const redacted = redactSensitivePreview(filePath, buffer.toString("utf8"));
-    return {
-        ok: true,
-        path: filePath,
-        absolutePath: safe.path,
-        size: stats.size,
-        language: languageForPath(filePath),
-        content: redacted.content,
-        truncated: false,
-        redacted: redacted.redacted
-    };
-}
-function fileViewStatus(error) {
-    if (/outside|Missing|Repository/.test(error))
-        return 400;
-    if (/does not exist/.test(error))
-        return 404;
-    if (/larger|Binary|not a file/.test(error))
-        return 415;
-    return 400;
-}
 async function readJsonBody(req) {
     const chunks = [];
     let size = 0;
@@ -384,173 +272,231 @@ async function readJsonBody(req) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         size += buffer.length;
         if (size > MAX_JSON_BODY_BYTES)
-            throw new Error(`JSON body exceeds ${MAX_JSON_BODY_BYTES} bytes`);
+            throw new HttpError(413, `Body exceeds ${MAX_JSON_BODY_BYTES} bytes`);
         chunks.push(buffer);
     }
-    if (chunks.length === 0)
+    if (!chunks.length)
         return {};
     try {
-        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error();
+        return parsed;
     }
     catch {
-        return {};
+        throw new HttpError(400, "Body must be a JSON object");
     }
 }
 function parseContextPackBody(body) {
     if (typeof body.id !== "string" || typeof body.name !== "string" || !Array.isArray(body.items))
         return undefined;
-    const now = new Date().toISOString();
-    const items = body.items.filter(isContextPackItem);
-    if (items.length !== body.items.length)
+    if (!body.items.every(isContextPackItem))
         return undefined;
+    const now = new Date().toISOString();
     return {
         id: body.id,
         name: body.name,
         createdAt: typeof body.createdAt === "string" ? body.createdAt : now,
         updatedAt: typeof body.updatedAt === "string" ? body.updatedAt : now,
         includeRawTranscript: body.includeRawTranscript === true,
-        items
+        items: body.items
     };
 }
 function isContextPackItem(value) {
     if (!value || typeof value !== "object")
         return false;
     const item = value;
-    return (typeof item.id === "string" &&
-        typeof item.blockId === "string" &&
-        typeof item.order === "number" &&
-        typeof item.enabled === "boolean" &&
-        isContextBlock(item.block));
+    return typeof item.id === "string" && typeof item.blockId === "string" && typeof item.order === "number" && typeof item.enabled === "boolean" && isContextBlock(item.block);
 }
+const CATEGORIES = new Set(["intent", "instruction", "decision", "constraint", "verification", "risk", "next-action", "changed-file", "transcript"]);
+const PROVENANCE = new Set(["user-authored", "transcript-derived", "diff-derived", "command-derived", "ai-inferred"]);
+const CONFIDENCE = new Set(["high", "medium", "low"]);
 function isContextBlock(value) {
     if (!value || typeof value !== "object")
         return false;
     const block = value;
-    const provenance = block.provenance;
+    const provenance = (block.provenance || {});
     return (typeof block.id === "string" &&
         typeof block.sourceHandoffId === "string" &&
         typeof block.sourceTask === "string" &&
         typeof block.sourceCreatedAt === "string" &&
-        isContextBlockCategory(block.category) &&
+        CATEGORIES.has(block.category) &&
         typeof block.title === "string" &&
         typeof block.text === "string" &&
         typeof block.estimatedChars === "number" &&
-        Boolean(provenance) &&
-        isProvenanceKind(provenance?.kind) &&
-        isConfidence(provenance?.confidence) &&
-        typeof provenance?.source === "string");
-}
-function isContextBlockCategory(value) {
-    return (value === "intent" ||
-        value === "instruction" ||
-        value === "decision" ||
-        value === "constraint" ||
-        value === "verification" ||
-        value === "risk" ||
-        value === "next-action" ||
-        value === "changed-file" ||
-        value === "transcript");
-}
-function isProvenanceKind(value) {
-    return value === "user-authored" || value === "transcript-derived" || value === "diff-derived" || value === "command-derived" || value === "ai-inferred";
-}
-function isConfidence(value) {
-    return value === "high" || value === "medium" || value === "low";
+        PROVENANCE.has(provenance.kind) &&
+        CONFIDENCE.has(provenance.confidence) &&
+        typeof provenance.source === "string");
+}
+// ---------------------------------------------------------------------------
+// Responses
+function setSecurityHeaders(res) {
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+    res.setHeader("Cross-Origin-Resource-Policy", "same-origin");
+}
+function sendJson(res, status, data) {
+    res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+    res.end(JSON.stringify(data));
+}
+function sendText(res, text) {
+    res.writeHead(200, { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" });
+    res.end(text);
+}
+function sendWebApp(res) {
+    const indexPath = join(webDistDir(), "index.html");
+    const html = existsSync(indexPath)
+        ? readFileSync(indexPath, "utf8")
+        : `<!doctype html><html><head><meta charset="utf-8"><title>ContextPool</title><style>body{font:15px/1.6 ui-sans-serif,system-ui;margin:15vh auto;max-width:34rem;padding:0 24px;color:#37352f}code{background:#f1f1ef;padding:2px 6px;border-radius:4px}</style></head><body><h1 style="font-weight:600;font-size:20px">UI assets are not built</h1><p>Run <code>npm run build</code>, then restart <code>ctxpool ui</code>.</p></body></html>`;
+    res.writeHead(200, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "content-security-policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'"
+    });
+    res.end(html);
+}
+function trySendStaticAsset(pathname, res) {
+    const extension = extname(pathname);
+    if (!extension)
+        return false;
+    const root = webDistDir();
+    const requested = resolve(root, `.${decodeURIComponent(pathname)}`);
+    const rel = relative(root, requested);
+    if (rel.startsWith("..") || isAbsolute(rel) || !existsSync(requested) || !statSync(requested).isFile())
+        return false;
+    res.writeHead(200, {
+        "content-type": contentType(extension),
+        "cache-control": rel.startsWith("assets") ? "public, max-age=31536000, immutable" : "no-cache"
+    });
+    createReadStream(requested).pipe(res);
+    return true;
 }
+function webDistDir() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), "..", "dist-web");
+}
+function contentType(extension) {
+    const types = {
+        ".html": "text/html; charset=utf-8",
+        ".js": "text/javascript; charset=utf-8",
+        ".css": "text/css; charset=utf-8",
+        ".svg": "image/svg+xml",
+        ".png": "image/png",
+        ".jpg": "image/jpeg",
+        ".jpeg": "image/jpeg",
+        ".webp": "image/webp",
+        ".woff2": "font/woff2",
+        ".ico": "image/x-icon"
+    };
+    return types[extension] || "application/octet-stream";
+}
+// ---------------------------------------------------------------------------
+// File preview
+export function readRepoFileForView(repoPath, filePath) {
+    const safe = resolveSafeRepoPath(repoPath, filePath);
+    if (!safe.ok)
+        return { ok: false, error: safe.error };
+    if (!existsSync(safe.path))
+        return { ok: false, path: filePath, error: "File does not exist on disk" };
+    const stats = statSync(safe.path);
+    if (!stats.isFile())
+        return { ok: false, path: filePath, error: "Path is not a file" };
+    if (stats.size > MAX_FILE_VIEW_BYTES)
+        return { ok: false, path: filePath, size: stats.size, error: `File is larger than ${MAX_FILE_VIEW_BYTES} bytes` };
+    const buffer = readFileSync(safe.path);
+    if (isBinaryFile(filePath, buffer))
+        return { ok: false, path: filePath, size: stats.size, error: "Binary files cannot be previewed" };
+    const preview = redactPreview(filePath, buffer.toString("utf8"));
+    return { ok: true, path: filePath, absolutePath: safe.path, size: stats.size, language: languageForPath(filePath), content: preview.content, truncated: false, redacted: preview.redacted };
+}
+/** Resolve `filePath` inside `repoPath`, following symlinks so a link cannot point outside the repository. */
 export function resolveSafeRepoPath(repoPath, filePath) {
     if (!repoPath || !filePath)
         return { ok: false, error: "Missing repoPath or path" };
     const repo = resolve(repoPath);
     if (!existsSync(repo))
         return { ok: false, error: "Repository path does not exist" };
-    if (isAbsolute(filePath)) {
-        const absoluteRelative = relative(repo, resolve(filePath));
-        if (absoluteRelative.startsWith("..") || isAbsolute(absoluteRelative))
-            return { ok: false, error: "File is outside the repository" };
-        return { ok: true, path: resolve(filePath) };
-    }
-    const fullPath = resolve(repo, filePath);
-    const rel = relative(repo, fullPath);
-    if (rel.startsWith("..") || isAbsolute(rel))
+    const target = isAbsolute(filePath) ? resolve(filePath) : resolve(repo, filePath);
+    if (!isInside(target, repo))
+        return { ok: false, error: "File is outside the repository" };
+    if (existsSync(target) && !isInside(realpathSync(target), realpathSync(repo)))
         return { ok: false, error: "File is outside the repository" };
-    return { ok: true, path: fullPath };
+    return { ok: true, path: target };
+}
+function isInside(path, root) {
+    const rel = relative(root, path);
+    return !rel.startsWith("..") && !isAbsolute(rel);
+}
+function fileViewStatus(error) {
+    if (/does not exist/.test(error))
+        return 404;
+    if (/larger|Binary|not a file/.test(error))
+        return 415;
+    return 400;
 }
 function isBinaryFile(path, buffer) {
     if (/\.(png|jpe?g|gif|webp|ico|pdf|zip|gz|tar|tgz|woff2?|ttf|otf|mp4|mov|mp3|wasm|sqlite|db)$/i.test(path))
         return true;
-    const sample = buffer.subarray(0, Math.min(buffer.length, 8192));
-    return sample.includes(0);
+    return buffer.subarray(0, Math.min(buffer.length, 8192)).includes(0);
 }
 function languageForPath(path) {
-    switch (extname(path).toLowerCase()) {
-        case ".ts":
-            return "typescript";
-        case ".tsx":
-            return "tsx";
-        case ".js":
-        case ".mjs":
-        case ".cjs":
-            return "javascript";
-        case ".jsx":
-            return "jsx";
-        case ".json":
-            return "json";
-        case ".css":
-            return "css";
-        case ".html":
-            return "html";
-        case ".md":
-        case ".mdx":
-            return "markdown";
-        case ".sql":
-            return "sql";
-        case ".py":
-            return "python";
-        case ".go":
-            return "go";
-        case ".rs":
-            return "rust";
-        case ".yml":
-        case ".yaml":
-            return "yaml";
-        case ".toml":
-            return "toml";
-        case ".sh":
-            return "shell";
-        default:
-            return "text";
-    }
+    const languages = {
+        ".ts": "typescript",
+        ".tsx": "tsx",
+        ".js": "javascript",
+        ".mjs": "javascript",
+        ".cjs": "javascript",
+        ".jsx": "jsx",
+        ".json": "json",
+        ".css": "css",
+        ".html": "html",
+        ".md": "markdown",
+        ".mdx": "markdown",
+        ".sql": "sql",
+        ".py": "python",
+        ".go": "go",
+        ".rs": "rust",
+        ".yml": "yaml",
+        ".yaml": "yaml",
+        ".toml": "toml",
+        ".sh": "shell"
+    };
+    return languages[extname(path).toLowerCase()] || "text";
 }
-function redactSensitivePreview(path, content) {
-    if (!/(^|\/)\.env(?:\.|$)|\.env\./i.test(path))
-        return { content, redacted: false };
-    let redacted = false;
-    const next = content.replace(/^(\s*(?:[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|DATABASE_URL|URL|DSN)[A-Z0-9_]*)\s*=\s*)(.+)$/gim, (_match, prefix, value) => {
-        if (!value || value.trim() === "" || value.trim().startsWith("#"))
-            return `${prefix}${value}`;
-        redacted = true;
-        return `${prefix}[redacted]`;
-    });
-    return { content: next, redacted };
+function redactPreview(path, content) {
+    let next = redactSecrets(content);
+    if (/(^|\/)\.env(?:\.|$)/i.test(path)) {
+        next = next.replace(/^(\s*(?:export\s+)?[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|DATABASE_URL|URL|DSN)[A-Z0-9_]*\s*=\s*)(.+)$/gim, (match, prefix, value) => value.trim() && !value.trim().startsWith("#") ? `${prefix}[redacted]` : match);
+    }
+    return { content: next, redacted: next !== content };
 }
+// Opening these with the OS handler would execute them; reveal them instead.
+const EXECUTABLE = /\.(app|command|tool|terminal|sh|bash|zsh|scpt|applescript|workflow|pkg|dmg|exe|bat|cmd|ps1|msi|desktop|jar)$/i;
 function openLocalFile(path, line, mode) {
-    const editor = process.env.CTXPOOL_EDITOR;
     const editorTarget = line ? `${path}:${line}` : path;
-    const candidates = mode === "reveal"
-        ? process.platform === "darwin"
-            ? [{ cmd: "open", args: ["-R", path], method: "open -R" }]
-            : [{ cmd: "xdg-open", args: [dirname(path)], method: "xdg-open parent" }]
-        : [
-            ...(editor ? [{ cmd: editor, args: [editorTarget], method: "CTXPOOL_EDITOR" }] : []),
-            { cmd: "code", args: ["-g", editorTarget], method: "code -g" },
-            { cmd: "cursor", args: ["-g", editorTarget], method: "cursor -g" },
-            ...(process.platform === "darwin" ? [{ cmd: "open", args: [path], method: "open" }] : [{ cmd: "xdg-open", args: [path], method: "xdg-open" }])
-        ];
-    for (const candidate of candidates) {
-        const result = spawnSync(candidate.cmd, candidate.args, { stdio: "ignore" });
+    const reveal = process.platform === "darwin"
+        ? [{ cmd: "open", args: ["-R", path], method: "open -R" }]
+        : process.platform === "win32"
+            ? [{ cmd: "explorer", args: [`/select,${path}`], method: "explorer" }]
+            : [{ cmd: "xdg-open", args: [dirname(path)], method: "xdg-open" }];
+    const editors = [
+        ...(process.env.CTXPOOL_EDITOR ? [{ cmd: process.env.CTXPOOL_EDITOR, args: [editorTarget], method: "CTXPOOL_EDITOR" }] : []),
+        { cmd: "cursor", args: ["-g", editorTarget], method: "cursor" },
+        { cmd: "code", args: ["-g", editorTarget], method: "code" },
+        { cmd: "zed", args: [editorTarget], method: "zed" }
+    ];
+    const systemOpen = EXECUTABLE.test(path)
+        ? reveal
+        : process.platform === "darwin"
+            ? [{ cmd: "open", args: ["-t", path], method: "open -t" }]
+            : process.platform === "win32"
+                ? []
+                : [{ cmd: "xdg-open", args: [path], method: "xdg-open" }];
+    for (const candidate of mode === "reveal" ? reveal : [...editors, ...systemOpen]) {
+        const result = spawnSync(candidate.cmd, candidate.args, { stdio: "ignore", timeout: 5_000 });
         if (!result.error && (result.status === 0 || result.status === null))
             return { ok: true, method: candidate.method };
     }
-    return { ok: false, error: "No local opener succeeded" };
+    return { ok: false, error: "No editor or file opener succeeded" };
 }
 //# sourceMappingURL=ui.js.map