deepdebug-local-agent 1.0.23 → 1.1.0

package/src/utils/sandbox.js

@@ -0,0 +1,182 @@
+/**
+ * sandbox.js — per-workspace filesystem/exec confinement (SEG-3, P0).
+ *
+ * DEFENSE IN DEPTH: the boundary lives HERE, in the agent — not only in the
+ * gateway. Even if the gateway passes a wrong path, the agent refuses any
+ * path that resolves (after `..` and symlinks) outside the workspace root.
+ *
+ * A workspace root is the directory that holds the N cloned repos of ONE
+ * workspace. Everything under it (repoA/…, repoB/…) is allowed — multi-repo,
+ * Copilot-style. Anything outside — a sibling workspace of the same tenant,
+ * another tenant, /etc, … — is DENIED.
+ *
+ * Why the previous checks failed (the A3 escape):
+ *   - `path.join(root, userPath)` with NO check → `../neighbor/x` escaped.
+ *   - `fullPath.startsWith(root)` (string prefix, no separator) → a sibling
+ *     `…/simple-api-2` matched `…/simple-api`, and `path.resolve` after `..`
+ *     still string-starts-with the root.
+ * Both are fixed here: we realpath the root and the resolved target's
+ * existing prefix, then require an exact match or a `root + path.sep` prefix.
+ */
+import fs from "fs";
+import path from "path";
+
+export class SandboxViolation extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = "SandboxViolation";
+    this.details = details;
+  }
+}
+
+/**
+ * Realpath the deepest existing ancestor of `p` (p itself may not exist yet,
+ * e.g. a file about to be written). This defeats symlinks anywhere along the
+ * path while still allowing creation of new files inside the root.
+ */
+function realpathExistingPrefix(p) {
+  let cur = path.resolve(p);
+  const tail = [];
+  // Walk up until we hit an existing path, remembering the non-existing tail.
+  // Bounded by the number of path segments (no infinite loop at fs root).
+  while (!fs.existsSync(cur)) {
+    const parent = path.dirname(cur);
+    if (parent === cur) break; // reached fs root
+    tail.unshift(path.basename(cur));
+    cur = parent;
+  }
+  let realBase;
+  try {
+    realBase = fs.realpathSync(cur);
+  } catch {
+    realBase = cur;
+  }
+  return tail.length ? path.join(realBase, ...tail) : realBase;
+}
+
+/**
+ * Resolve `requested` against `root` and confine it to `root`.
+ *
+ * @param {string} root       Absolute workspace root (the dir holding the repos).
+ * @param {string} requested  Path from the caller: relative (repoA/src/x), or
+ *                            absolute — an absolute path is allowed ONLY when it
+ *                            is already inside the root; an absolute path that
+ *                            points outside (another workspace, /etc, …) is
+ *                            DENIED, not silently re-based.
+ * @returns {string}          The confined absolute path (safe to fs-op / cwd).
+ * @throws  {SandboxViolation} when it resolves outside the root.
+ */
+export function confineToRoot(root, requested) {
+  if (!root || typeof root !== "string") {
+    throw new SandboxViolation("workspace root not set", { root });
+  }
+  const realRoot = realpathExistingPrefix(root);
+
+  const req = requested == null ? "" : String(requested);
+  // Absolute → resolve as filesystem-absolute (must land inside root).
+  // Relative → resolve against root. Either way, symlinks/`..` are collapsed by
+  // realpathExistingPrefix before the containment check.
+  const target = path.isAbsolute(req)
+    ? realpathExistingPrefix(req)
+    : realpathExistingPrefix(path.resolve(realRoot, req));
+
+  if (target !== realRoot && !target.startsWith(realRoot + path.sep)) {
+    throw new SandboxViolation("path escapes the workspace sandbox", {
+      root: realRoot,
+      requested: req,
+      resolved: target,
+    });
+  }
+  return target;
+}
+
+/** Boolean form — never throws. */
+export function isInsideRoot(root, requested) {
+  try {
+    confineToRoot(root, requested);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Best-effort confinement for a run_command whose arguments are tokenized
+ * (e.g. /workspace/run with args[]). Rejects any argument that looks like a
+ * path (absolute, or containing a `..` segment) and resolves outside the root.
+ * cwd is always pinned to the root by the caller; this catches explicit
+ * out-of-root path arguments. Raw-shell endpoints get the scanRawCommand
+ * heuristic instead.
+ *
+ * @returns {{ok:true}|{ok:false,arg:string,resolved:string}}
+ */
+export function checkArgsWithinRoot(root, args = []) {
+  const realRoot = realpathExistingPrefix(root);
+  for (const a of args) {
+    if (typeof a !== "string") continue;
+    const looksPath = path.isAbsolute(a) || a.includes("..") || a.includes("/") || a.includes("\\");
+    if (!looksPath) continue;
+
+    if (path.isAbsolute(a)) {
+      // Absolute arg → resolve as FILESYSTEM-absolute (do NOT strip the leading
+      // slash and re-base under root — that rebasing let `/etc/passwd` and
+      // `/tmp/workspaces/<other>` pass the containment check while `run()`
+      // still executed the real absolute path). Mirror scanRawCommand: allow
+      // only paths inside the root or a normal system-binary/toolchain path;
+      // deny anything else (other workspace roots, /etc, /home, /tmp, …).
+      const resolved = path.resolve(a);
+      const inside = resolved === realRoot || resolved.startsWith(realRoot + path.sep);
+      const systemBinary = /^\/(usr|bin|sbin|lib|lib64|opt|etc\/alternatives)(\/|$)/.test(resolved);
+      const sensitive = /^\/(tmp\/workspaces|mnt\/workspaces|home|root|workspace|Users|etc|var\/secrets)(\/|$)/.test(resolved);
+      if (!inside && (sensitive || (!systemBinary && /^\/(tmp|var|mnt)/.test(resolved)))) {
+        return { ok: false, arg: a, resolved };
+      }
+      continue;
+    }
+
+    // Relative arg → resolve against the root. `..` that climbs out escapes.
+    const resolved = path.resolve(realRoot, a);
+    if (a.includes("..") &&
+        resolved !== realRoot && !resolved.startsWith(realRoot + path.sep)) {
+      return { ok: false, arg: a, resolved };
+    }
+  }
+  return { ok: true };
+}
+
+/**
+ * Best-effort scan of a raw shell command string for out-of-root escapes:
+ * absolute paths outside root, `..` traversal, and cwd changes (`cd /...`).
+ * This is a heuristic — full shell containment needs OS namespaces — but it
+ * blocks the obvious `cat ../neighbor/x` / `cd /etc` cases. cwd stays pinned.
+ *
+ * @returns {{ok:true}|{ok:false,reason:string,token:string}}
+ */
+export function scanRawCommand(root, command) {
+  if (!command || typeof command !== "string") return { ok: true };
+  const realRoot = realpathExistingPrefix(root);
+  // Tokens that look like filesystem paths.
+  const tokens = command.split(/\s+|["'`;|&(){}<>]+/).filter(Boolean);
+  for (const t of tokens) {
+    // `..` traversal anywhere.
+    if (/(^|\/)\.\.(\/|$)/.test(t)) {
+      const resolved = path.resolve(realRoot, t.replace(/^[/\\]+/, ""));
+      if (resolved !== realRoot && !resolved.startsWith(realRoot + path.sep)) {
+        return { ok: false, reason: "parent-traversal escapes workspace", token: t };
+      }
+    }
+    // Absolute path that is neither inside the root nor a normal system binary
+    // (allow /usr, /bin, /opt toolchains; deny absolute paths into other
+    // workspace roots, /home, /mnt, /etc, /tmp/workspaces/<other>, …).
+    if (path.isAbsolute(t)) {
+      const resolved = path.resolve(t);
+      const inside = resolved === realRoot || resolved.startsWith(realRoot + path.sep);
+      const systemBinary = /^\/(usr|bin|sbin|lib|lib64|opt|etc\/alternatives)(\/|$)/.test(resolved);
+      const sensitive = /^\/(tmp\/workspaces|mnt\/workspaces|home|root|workspace|Users|etc|var\/secrets)(\/|$)/.test(resolved);
+      if (!inside && (sensitive || (!systemBinary && /^\/(tmp|var|mnt)/.test(resolved)))) {
+        return { ok: false, reason: "absolute path outside workspace", token: t };
+      }
+    }
+  }
+  return { ok: true };
+}

package/src/utils/search-outcome.js

@@ -0,0 +1,56 @@
+// search-outcome.js - pure classification of a grep failure for POST /workspace/search.
+//
+// grep over a multi-repo parent (6 clones, no file filter) can exceed the 15 s
+// execSync timeout. execSync then throws with `killed: true` / `signal: 'SIGTERM'`
+// and `status: null`, and the handler fell through to `throw grepErr` -> HTTP 500.
+// The platform then raised an incident on its own agent (QA 2026-10-14..15,
+// hash b83215a8) and the AI, calling search_code in a loop, saw "search_code
+// error: 500" instead of the lines grep had already found.
+//
+// A timeout (or an output cap) is an answer, not a crash: return what grep
+// produced so far, say it is partial, and tell the caller how to narrow.
+
+/**
+ * @param {object} grepErr the error execSync threw
+ * @param {object} [opts]
+ * @param {number} [opts.timeoutMs] the timeout that was configured (for the hint)
+ * @returns {{kind: 'no_match'} | {kind: 'bad_pattern', message: string}
+ *   | {kind: 'partial', reason: 'search_timeout'|'output_cap', stdout: string}
+ *   | {kind: 'unknown'}}
+ */
+export function classifyGrepFailure(grepErr, { timeoutMs } = {}) {
+  if (!grepErr) return { kind: 'unknown' };
+  // grep exit 1 = no matches (only when grep itself finished)
+  if (grepErr.status === 1 && !grepErr.killed) return { kind: 'no_match' };
+  // grep exit 2 = pattern/usage error
+  if (grepErr.status === 2 && !grepErr.killed) {
+    return { kind: 'bad_pattern', message: String(grepErr.message || '') };
+  }
+  const stdout = typeof grepErr.stdout === 'string' ? grepErr.stdout : '';
+  if (grepErr.killed || grepErr.signal === 'SIGTERM' || grepErr.code === 'ETIMEDOUT') {
+    return { kind: 'partial', reason: 'search_timeout', stdout, timeoutMs };
+  }
+  if (grepErr.code === 'ENOBUFS') {
+    return { kind: 'partial', reason: 'output_cap', stdout };
+  }
+  return { kind: 'unknown' };
+}
+
+/** Body for a partial outcome: HTTP 200, ok:false, what we have, and how to narrow. */
+export function partialSearchBody(pattern, outcome, relativize) {
+  const lines = (outcome.stdout || '').split('\n').filter((l) => l.trim());
+  const results = lines.map(relativize).join('\n');
+  const why = outcome.reason === 'search_timeout'
+    ? `grep exceeded ${Math.round((outcome.timeoutMs || 0) / 1000)} s`
+    : 'grep output exceeded the buffer';
+  return {
+    ok: false,
+    error: outcome.reason,
+    partial: true,
+    results,
+    count: lines.length,
+    hint: `${why} for pattern "${pattern}". The ${lines.length} match(es) above are partial. `
+      + 'Narrow the search: pass file_filter (e.g. "*.js"), name the repo (repo=<dir>) '
+      + 'in a multi-repo workspace, or use a more specific pattern.'
+  };
+}

package/src/utils/workspace-root.js

@@ -0,0 +1,80 @@
+/**
+ * workspace-root.js — validation of the X-Workspace-Root header.
+ *
+ * WHY. resolveWorkspaceRoot() used the header verbatim as the confinement root
+ * for every exec/file route, and the header is NOT part of the Ed25519
+ * canonical string (request-signing.js). So a caller could name `/` or another
+ * tenant's directory on the shared NFS and the "sandbox" confined paths to
+ * that: the sandbox was self-declared (security review 2026-10-11, H4).
+ *
+ * Rule: the root must be an absolute, normalised path strictly inside one of
+ * the workspace base directories (WORKSPACES_MOUNT, WORKSPACE_MOUNT,
+ * WORKSPACE_ROOT, LOCAL_AGENT_WORKSPACE_BASES) or be / be inside a workspace
+ * registered in the WorkspaceManager. When the request carries a VERIFIED
+ * signature with a tenantId, a registered workspace that belongs to another
+ * tenant is refused. Pure function, unit-tested in test/workspace-root.test.js.
+ */
+import path from "node:path";
+
+/**
+ * WORKSPACE_ROOT (docker-compose / Helm single-workspace agents) IS a
+ * workspace, not a directory of workspaces: accepted exactly or below.
+ */
+export function exactWorkspaceRoots(env = process.env) {
+    const s = String(env.WORKSPACE_ROOT || "").trim();
+    if (!s || !path.isAbsolute(s)) return [];
+    const n = path.resolve(s);
+    return n === path.parse(n).root ? [] : [n];
+}
+
+export function workspaceBases(env = process.env) {
+    const raw = [
+        env.WORKSPACES_MOUNT || "/mnt/workspaces",
+        env.WORKSPACE_MOUNT || "/tmp/workspaces",
+        ...String(env.LOCAL_AGENT_WORKSPACE_BASES || "").split(","),
+    ];
+    const out = new Set();
+    for (const b of raw) {
+        const s = String(b || "").trim();
+        if (!s || !path.isAbsolute(s)) continue;
+        const n = path.resolve(s);
+        if (n !== path.parse(n).root) out.add(n);
+    }
+    return [...out];
+}
+
+function inside(base, p) {
+    const rel = path.relative(base, p);
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
+/**
+ * @param {string} raw header value
+ * @param {{bases?: string[], exact?: string[], registry?: Array<{root?: string, tenantId?: string|null}>, tenantId?: string|null}} opts
+ *        tenantId = tenant bound by a VERIFIED signature (undefined when unsigned).
+ * @returns {{ok: true, root: string} | {ok: false, reason: string}}
+ */
+export function validateHeaderRoot(raw, opts = {}) {
+    const s = String(raw || "").trim();
+    if (!s) return { ok: false, reason: "empty root" };
+    if (s.includes("\0")) return { ok: false, reason: "invalid characters in root" };
+    if (!path.isAbsolute(s)) return { ok: false, reason: "root must be an absolute path" };
+    const root = path.resolve(s);
+    if (root === path.parse(root).root) return { ok: false, reason: "filesystem root is not a workspace" };
+
+    const registry = Array.isArray(opts.registry) ? opts.registry : [];
+    const owner = registry.find(w => w && w.root && inside(path.resolve(w.root), root));
+    if (owner && opts.tenantId && owner.tenantId && owner.tenantId !== opts.tenantId) {
+        return { ok: false, reason: "root belongs to another tenant" };
+    }
+    if (owner) return { ok: true, root };
+
+    const exact = opts.exact || exactWorkspaceRoots();
+    if (exact.some(e => inside(e, root))) return { ok: true, root };
+
+    const bases = opts.bases || workspaceBases();
+    // A workspace is a child of a base (the base itself is shared by every
+    // tenant); the tenant/workspace segment must exist (strictly inside).
+    if (bases.some(b => inside(b, root) && root !== b)) return { ok: true, root };
+    return { ok: false, reason: "root is outside every workspace base directory" };
+}

package/src/validators/syntax-validator.js

@@ -0,0 +1,149 @@
+/**
+ * syntax-validator.js — Camada 2 (SyntaxValidator) of the fix validation
+ * ladder. Parse-only, NEVER builds. Resolved per file extension:
+ *
+ *   .js/.jsx/.mjs/.cjs/.ts/.tsx → TypeScript compiler front-end (pure JS,
+ *       syntactic diagnostics only — no type check, no emit).
+ *   .swift → tree-sitter + tree-sitter-swift (native prebuilds; the grammar
+ *       is used INSTEAD of `swiftc -parse` on purpose: swiftc fails on
+ *       unresolved iOS framework imports, the grammar does not).
+ *   .java → skipped here (the engine validates Java in-process with
+ *       JavaParser, which is stricter than tree-sitter).
+ *   anything else → validator 'none' (tier degrades, never blocks).
+ *
+ * Every dependency is lazy-loaded and failure-isolated: a missing/broken
+ * parser downgrades that file to {validator:'none'} instead of erroring.
+ */
+import path from 'path';
+import { promises as fs } from 'fs';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+
+const MAX_PROBLEMS_PER_FILE = 5;
+const MAX_FILE_BYTES = 1_000_000;
+
+let tsModule;            // lazy typescript
+let swiftParser;         // lazy tree-sitter parser wired to swift grammar
+let swiftLoadFailed = false;
+
+function loadTypescript() {
+    if (tsModule !== undefined) return tsModule;
+    try {
+        tsModule = require('typescript');
+    } catch (err) {
+        console.warn('[SyntaxValidator] typescript unavailable, JS/TS tier degrades:', err.message);
+        tsModule = null;
+    }
+    return tsModule;
+}
+
+function loadSwiftParser() {
+    if (swiftParser || swiftLoadFailed) return swiftParser || null;
+    try {
+        const Parser = require('tree-sitter');
+        const Swift = require('tree-sitter-swift');
+        const parser = new Parser();
+        parser.setLanguage(Swift);
+        swiftParser = parser;
+    } catch (err) {
+        console.warn('[SyntaxValidator] tree-sitter-swift unavailable, Swift tier degrades:', err.message);
+        swiftLoadFailed = true;
+    }
+    return swiftParser || null;
+}
+
+function validateWithTypescript(filePath, source) {
+    const ts = loadTypescript();
+    if (!ts) return { validator: 'none', ok: true, problems: [] };
+
+    const ext = path.extname(filePath).toLowerCase();
+    const scriptKind =
+        ext === '.tsx' ? ts.ScriptKind.TSX :
+        ext === '.jsx' ? ts.ScriptKind.JSX :
+        ext === '.ts'  ? ts.ScriptKind.TS  :
+                         ts.ScriptKind.JS;
+
+    const sf = ts.createSourceFile(filePath, source, ts.ScriptTarget.Latest, true, scriptKind);
+    // parseDiagnostics is a stable-in-practice internal: syntactic errors only.
+    const diags = sf.parseDiagnostics || [];
+    const problems = diags.slice(0, MAX_PROBLEMS_PER_FILE).map(d => {
+        const { line, character } = ts.getLineAndCharacterOfPosition(sf, d.start ?? 0);
+        return {
+            line: line + 1,
+            col: character + 1,
+            message: ts.flattenDiagnosticMessageText(d.messageText, ' '),
+        };
+    });
+    return { validator: 'typescript', ok: problems.length === 0, problems };
+}
+
+function collectTreeSitterErrors(node, problems) {
+    if (problems.length >= MAX_PROBLEMS_PER_FILE) return;
+    if (node.type === 'ERROR' || node.isMissing) {
+        problems.push({
+            line: node.startPosition.row + 1,
+            col: node.startPosition.column + 1,
+            message: node.isMissing
+                ? `missing ${node.type}`
+                : `syntax error near "${node.text.slice(0, 60).replace(/\n/g, '\\n')}"`,
+        });
+        return; // children of an ERROR node are noise
+    }
+    if (!node.hasError) return; // prune healthy subtrees
+    for (let i = 0; i < node.childCount; i++) {
+        collectTreeSitterErrors(node.child(i), problems);
+        if (problems.length >= MAX_PROBLEMS_PER_FILE) return;
+    }
+}
+
+function validateSwift(source) {
+    const parser = loadSwiftParser();
+    if (!parser) return { validator: 'none', ok: true, problems: [] };
+    const tree = parser.parse(source);
+    const problems = [];
+    if (tree.rootNode.hasError) collectTreeSitterErrors(tree.rootNode, problems);
+    if (tree.rootNode.hasError && problems.length === 0) {
+        problems.push({ line: 1, col: 1, message: 'unparseable swift (no detail)' });
+    }
+    return { validator: 'tree-sitter-swift', ok: problems.length === 0, problems };
+}
+
+const JS_TS_EXTS = new Set(['.js', '.jsx', '.mjs', '.cjs', '.ts', '.tsx']);
+
+/**
+ * Validate a list of workspace-relative paths. Path traversal outside the
+ * workspace root is rejected per-file (never throws for the whole batch).
+ */
+export async function validateFiles(workspaceRoot, relativePaths) {
+    const results = [];
+    for (const rel of relativePaths || []) {
+        const entry = { path: rel, validator: 'none', ok: true, problems: [] };
+        try {
+            const abs = path.resolve(workspaceRoot, rel);
+            if (!abs.startsWith(path.resolve(workspaceRoot) + path.sep)) {
+                results.push({ ...entry, ok: false, validator: 'security',
+                    problems: [{ line: 0, col: 0, message: 'path escapes workspace root' }] });
+                continue;
+            }
+            const stat = await fs.stat(abs).catch(() => null);
+            if (!stat || !stat.isFile() || stat.size > MAX_FILE_BYTES) {
+                results.push(entry); // absent/huge → skip, never block
+                continue;
+            }
+            const source = await fs.readFile(abs, 'utf8');
+            const ext = path.extname(rel).toLowerCase();
+            if (JS_TS_EXTS.has(ext)) {
+                results.push({ path: rel, ...validateWithTypescript(rel, source) });
+            } else if (ext === '.swift') {
+                results.push({ path: rel, ...validateSwift(source) });
+            } else {
+                results.push(entry); // .java handled engine-side; others no-op
+            }
+        } catch (err) {
+            console.warn(`[SyntaxValidator] ${rel} crashed, failing open:`, err.message);
+            results.push(entry);
+        }
+    }
+    return results;
+}

package/src/workspace/detect-port.js

@@ -1,14 +1,14 @@
-// Adicionar no server.js do Local Agent
+// Add this to the Local Agent's server.js
 
 /**
  * GET /workspace/detect-port
  *
- * Detecta porta de um serviço específico lendo arquivos de configuração
+ * Detects the port of a specific service by reading configuration files
  *
  * Query params:
- * - servicePath: caminho relativo do serviço
- * - language: linguagem do serviço
- * - framework: framework do serviço
+ * - servicePath: relative path of the service
+ * - language: language of the service
+ * - framework: framework of the service
  */
 app.get("/workspace/detect-port", async (req, res) => {
     if (!WORKSPACE_ROOT) {
@@ -32,7 +32,7 @@ app.get("/workspace/detect-port", async (req, res) => {
 
         let port = null;
 
-        // Detectar porta baseado na linguagem/framework
+        // Detect the port based on language/framework
         if (language === 'java' && framework === 'spring-boot') {
             port = await detectSpringBootPort(fullPath);
         } else if (language === 'node') {
@@ -53,7 +53,7 @@ app.get("/workspace/detect-port", async (req, res) => {
 });
 
 /**
- * Detecta porta do Spring Boot
+ * Detects the Spring Boot port
  */
 async function detectSpringBootPort(servicePath) {
     const candidates = [
@@ -95,10 +95,10 @@ async function detectSpringBootPort(servicePath) {
 }
 
 /**
- * Detecta porta do Node.js
+ * Detects the Node.js port
  */
 async function detectNodePort(servicePath) {
-    // Tentar .env
+    // Try .env
     const envPath = path.join(servicePath, '.env');
     if (await exists(envPath)) {
         const content = await readFile(envPath, 'utf8');
@@ -109,13 +109,13 @@ async function detectNodePort(servicePath) {
         }
     }
 
-    // Tentar package.json scripts
+    // Try package.json scripts
     const pkgPath = path.join(servicePath, 'package.json');
     if (await exists(pkgPath)) {
         const content = await readFile(pkgPath, 'utf8');
         const pkg = JSON.parse(content);
 
-        // Procurar por --port ou PORT= nos scripts
+        // Look for --port or PORT= in the scripts
         const scripts = JSON.stringify(pkg.scripts || {});
         const match = scripts.match(/--port[=\s]+(\d+)|PORT[=\s]+(\d+)/i);
         if (match) {
@@ -130,10 +130,10 @@ async function detectNodePort(servicePath) {
 }
 
 /**
- * Detecta porta do Python
+ * Detects the Python port
  */
 async function detectPythonPort(servicePath) {
-    // Tentar .env
+    // Try .env
     const envPath = path.join(servicePath, '.env');
     if (await exists(envPath)) {
         const content = await readFile(envPath, 'utf8');
@@ -144,13 +144,13 @@ async function detectPythonPort(servicePath) {
         }
     }
 
-    // Defaults por framework
+    // Defaults per framework
     console.log('⚠️ No port config found, using framework default');
     return 8000; // Default Django/FastAPI
 }
 
 /**
- * Detecta porta do .NET
+ * Detects the .NET port
  */
 async function detectDotNetPort(servicePath) {
     const launchSettings = path.join(servicePath, 'Properties/launchSettings.json');
@@ -159,7 +159,7 @@ async function detectDotNetPort(servicePath) {
         const content = await readFile(launchSettings, 'utf8');
         const settings = JSON.parse(content);
 
-        // Procurar em profiles
+        // Look inside profiles
         const profiles = settings.profiles || {};
         for (const profile of Object.values(profiles)) {
             if (profile.applicationUrl) {

package/src/workspace/file-reader.js

@@ -10,7 +10,7 @@ export class FileReader {
     async read(relativePath) {
         const fullPath = path.join(this.rootPath, relativePath);
 
-        // Validação de segurança - previne path traversal
+        // Security validation - prevents path traversal
         if (!fullPath.startsWith(this.rootPath)) {
             throw new Error('Path traversal detected');
         }