devchain-cli 0.6.1 → 0.7.1

package/dist/drizzle/0024_review_tables.sql

@@ -0,0 +1,71 @@
+-- Code Review Tables Migration
+-- Adds reviews, review_comments, and review_comment_targets tables
+
+CREATE TABLE `reviews` (
+	`id` text PRIMARY KEY NOT NULL,
+	`project_id` text NOT NULL,
+	`epic_id` text,
+	`title` text NOT NULL,
+	`description` text,
+	`status` text NOT NULL,
+	`base_ref` text NOT NULL,
+	`head_ref` text NOT NULL,
+	`base_sha` text NOT NULL,
+	`head_sha` text NOT NULL,
+	`created_by` text NOT NULL,
+	`created_by_agent_id` text,
+	`version` integer DEFAULT 1 NOT NULL,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL,
+	FOREIGN KEY (`project_id`) REFERENCES `projects`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`epic_id`) REFERENCES `epics`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`created_by_agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+CREATE INDEX `reviews_project_id_idx` ON `reviews` (`project_id`);
+--> statement-breakpoint
+CREATE INDEX `reviews_epic_id_idx` ON `reviews` (`epic_id`);
+--> statement-breakpoint
+CREATE INDEX `reviews_status_idx` ON `reviews` (`status`);
+--> statement-breakpoint
+CREATE TABLE `review_comments` (
+	`id` text PRIMARY KEY NOT NULL,
+	`review_id` text NOT NULL,
+	`file_path` text,
+	`parent_id` text,
+	`line_start` integer,
+	`line_end` integer,
+	`side` text,
+	`content` text NOT NULL,
+	`comment_type` text NOT NULL,
+	`status` text NOT NULL,
+	`author_type` text NOT NULL,
+	`author_agent_id` text,
+	`version` integer DEFAULT 1 NOT NULL,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL,
+	FOREIGN KEY (`review_id`) REFERENCES `reviews`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`parent_id`) REFERENCES `review_comments`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`author_agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+CREATE INDEX `review_comments_review_id_idx` ON `review_comments` (`review_id`);
+--> statement-breakpoint
+CREATE INDEX `review_comments_parent_id_idx` ON `review_comments` (`parent_id`);
+--> statement-breakpoint
+CREATE INDEX `review_comments_file_path_idx` ON `review_comments` (`file_path`);
+--> statement-breakpoint
+CREATE INDEX `review_comments_status_idx` ON `review_comments` (`status`);
+--> statement-breakpoint
+CREATE TABLE `review_comment_targets` (
+	`id` text PRIMARY KEY NOT NULL,
+	`comment_id` text NOT NULL,
+	`agent_id` text NOT NULL,
+	`created_at` text NOT NULL,
+	FOREIGN KEY (`comment_id`) REFERENCES `review_comments`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `review_comment_targets_comment_id_idx` ON `review_comment_targets` (`comment_id`);
+--> statement-breakpoint
+CREATE INDEX `review_comment_targets_agent_id_idx` ON `review_comment_targets` (`agent_id`);

package/dist/drizzle/0025_reviews_mode_and_nullable_shas.sql

@@ -0,0 +1,80 @@
+-- Reviews schema update for live pre-commit review
+-- 1) Add `mode` column to `reviews`
+-- 2) Make `base_sha` / `head_sha` nullable for working_tree mode
+-- 3) Enforce single active review per project (status != 'closed')
+
+PRAGMA foreign_keys=OFF;
+--> statement-breakpoint
+CREATE TABLE `__new_reviews` (
+	`id` text PRIMARY KEY NOT NULL,
+	`project_id` text NOT NULL,
+	`epic_id` text,
+	`title` text NOT NULL,
+	`description` text,
+	`status` text NOT NULL,
+	`mode` text DEFAULT 'commit' NOT NULL,
+	`base_ref` text NOT NULL,
+	`head_ref` text NOT NULL,
+	`base_sha` text,
+	`head_sha` text,
+	`created_by` text NOT NULL,
+	`created_by_agent_id` text,
+	`version` integer DEFAULT 1 NOT NULL,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL,
+	FOREIGN KEY (`project_id`) REFERENCES `projects`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`epic_id`) REFERENCES `epics`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`created_by_agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+INSERT INTO `__new_reviews` (
+	`id`,
+	`project_id`,
+	`epic_id`,
+	`title`,
+	`description`,
+	`status`,
+	`mode`,
+	`base_ref`,
+	`head_ref`,
+	`base_sha`,
+	`head_sha`,
+	`created_by`,
+	`created_by_agent_id`,
+	`version`,
+	`created_at`,
+	`updated_at`
+)
+SELECT
+	`id`,
+	`project_id`,
+	`epic_id`,
+	`title`,
+	`description`,
+	`status`,
+	'commit' as `mode`,
+	`base_ref`,
+	`head_ref`,
+	`base_sha`,
+	`head_sha`,
+	`created_by`,
+	`created_by_agent_id`,
+	`version`,
+	`created_at`,
+	`updated_at`
+FROM `reviews`;
+--> statement-breakpoint
+DROP TABLE `reviews`;
+--> statement-breakpoint
+ALTER TABLE `__new_reviews` RENAME TO `reviews`;
+
+--> statement-breakpoint
+CREATE INDEX `reviews_project_id_idx` ON `reviews` (`project_id`);
+--> statement-breakpoint
+CREATE INDEX `reviews_epic_id_idx` ON `reviews` (`epic_id`);
+--> statement-breakpoint
+CREATE INDEX `reviews_status_idx` ON `reviews` (`status`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `reviews_project_active_unique` ON `reviews` (`project_id`) WHERE `status` != 'closed';
+--> statement-breakpoint
+PRAGMA foreign_keys=ON;

package/dist/drizzle/0026_review_comments_edited_at.sql

@@ -0,0 +1,2 @@
+-- Add edited_at column to review_comments table
+ALTER TABLE `review_comments` ADD COLUMN `edited_at` text;

package/dist/drizzle/meta/_journal.json

@@ -169,6 +169,27 @@
       "when": 1767783341227,
       "tag": "0023_add_guest_description",
       "breakpoints": true
+    },
+    {
+      "idx": 24,
+      "version": "7",
+      "when": 1769880000000,
+      "tag": "0024_review_tables",
+      "breakpoints": true
+    },
+    {
+      "idx": 25,
+      "version": "7",
+      "when": 1769880000001,
+      "tag": "0025_reviews_mode_and_nullable_shas",
+      "breakpoints": true
+    },
+    {
+      "idx": 26,
+      "version": "7",
+      "when": 1769880000002,
+      "tag": "0026_review_comments_edited_at",
+      "breakpoints": true
     }
   ]
-}
+}

package/dist/server/common/errors/error-types.d.ts

@@ -13,6 +13,9 @@ export declare class ValidationError extends AppError {
 export declare class ConflictError extends AppError {
     constructor(message: string, details?: Record<string, unknown>);
 }
+export declare class ForbiddenError extends AppError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
 export declare class OptimisticLockError extends AppError {
     constructor(resource: string, identifier: string, details?: Record<string, unknown>);
 }

package/dist/server/common/errors/error-types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UnsupportedProviderError = exports.TimeoutError = exports.BusyError = exports.IOError = exports.StorageError = exports.OptimisticLockError = exports.ConflictError = exports.ValidationError = exports.NotFoundError = exports.AppError = void 0;
+exports.UnsupportedProviderError = exports.TimeoutError = exports.BusyError = exports.IOError = exports.StorageError = exports.OptimisticLockError = exports.ForbiddenError = exports.ConflictError = exports.ValidationError = exports.NotFoundError = exports.AppError = void 0;
 class AppError extends Error {
     constructor(message, code, statusCode = 500, details) {
         super(message);
@@ -30,6 +30,12 @@ class ConflictError extends AppError {
     }
 }
 exports.ConflictError = ConflictError;
+class ForbiddenError extends AppError {
+    constructor(message, details) {
+        super(message, 'forbidden', 403, details);
+    }
+}
+exports.ForbiddenError = ForbiddenError;
 class OptimisticLockError extends AppError {
     constructor(resource, identifier, details) {
         super(`${resource} with identifier ${identifier} was modified by another operation. Please refresh and try again.`, 'optimistic_lock_error', 409, details);

package/dist/server/common/errors/error-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-types.js","sourceRoot":"","sources":["../../../src/common/errors/error-types.ts"],"names":[],"mappings":";;;AAAA,MAAa,QAAS,SAAQ,KAAK;IACjC,YACE,OAAe,EACC,IAAY,EACZ,aAAqB,GAAG,EACxB,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAc;QACxB,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;CACF;AAXD,4BAWC;AAED,MAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,QAAgB,EAAE,UAAmB;QAC/C,KAAK,CACH,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAC5E,WAAW,EACX,GAAG,CACJ,CAAC;IACJ,CAAC;CACF;AARD,sCAQC;AAED,MAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAJD,0CAIC;AAED,MAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAJD,sCAIC;AAED,MAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,QAAgB,EAAE,UAAkB,EAAE,OAAiC;QACjF,KAAK,CACH,GAAG,QAAQ,oBAAoB,UAAU,mEAAmE,EAC5G,uBAAuB,EACvB,GAAG,EACH,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AATD,kDASC;AAED,MAAa,YAAa,SAAQ,QAAQ;IACxC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;AAJD,oCAIC;AAED,MAAa,OAAQ,SAAQ,QAAQ;IACnC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAJD,0BAIC;AAED,MAAa,SAAU,SAAQ,QAAQ;IACrC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;CACF;AAJD,8BAIC;AAED,MAAa,YAAa,SAAQ,QAAQ;IACxC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AAJD,oCAIC;AAED,MAAa,wBAAyB,SAAQ,QAAQ;IACpD,YACkB,YAAoB,EACpC,kBAA4B;QAE5B,KAAK,CACH,yBAAyB,YAAY,0BAA0B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC9F,sBAAsB,EACtB,GAAG,EACH,EAAE,YAAY,EAAE,kBAAkB,EAAE,CACrC,CAAC;QARc,iBAAY,GAAZ,YAAY,CAAQ;IAStC,CAAC;CACF;AAZD,4DAYC"}
+{"version":3,"file":"error-types.js","sourceRoot":"","sources":["../../../src/common/errors/error-types.ts"],"names":[],"mappings":";;;AAAA,MAAa,QAAS,SAAQ,KAAK;IACjC,YACE,OAAe,EACC,IAAY,EACZ,aAAqB,GAAG,EACxB,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAc;QACxB,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;CACF;AAXD,4BAWC;AAED,MAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,QAAgB,EAAE,UAAmB;QAC/C,KAAK,CACH,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAC5E,WAAW,EACX,GAAG,CACJ,CAAC;IACJ,CAAC;CACF;AARD,sCAQC;AAED,MAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAJD,0CAIC;AAED,MAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAJD,sCAIC;AAED,MAAa,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;AAJD,wCAIC;AAED,MAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,QAAgB,EAAE,UAAkB,EAAE,OAAiC;QACjF,KAAK,CACH,GAAG,QAAQ,oBAAoB,UAAU,mEAAmE,EAC5G,uBAAuB,EACvB,GAAG,EACH,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AATD,kDASC;AAED,MAAa,YAAa,SAAQ,QAAQ;IACxC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;AAJD,oCAIC;AAED,MAAa,OAAQ,SAAQ,QAAQ;IACnC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAJD,0BAIC;AAED,MAAa,SAAU,SAAQ,QAAQ;IACrC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;CACF;AAJD,8BAIC;AAED,MAAa,YAAa,SAAQ,QAAQ;IACxC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AAJD,oCAIC;AAED,MAAa,wBAAyB,SAAQ,QAAQ;IACpD,YACkB,YAAoB,EACpC,kBAA4B;QAE5B,KAAK,CACH,yBAAyB,YAAY,0BAA0B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC9F,sBAAsB,EACtB,GAAG,EACH,EAAE,YAAY,EAAE,kBAAkB,EAAE,CACrC,CAAC;QARc,iBAAY,GAAZ,YAAY,CAAQ;IAStC,CAAC;CACF;AAZD,4DAYC"}

package/dist/server/common/validation/path-validation.d.ts

@@ -0,0 +1,11 @@
+export interface ValidatedPath {
+    absolutePath: string;
+    relativePath: string;
+}
+export interface PathValidationOptions {
+    allowNonExistent?: boolean;
+    errorPrefix?: string;
+}
+export declare function validatePathWithinRoot(rootPath: string, filePath: string, options?: PathValidationOptions): ValidatedPath;
+export declare function validateLineBounds(lineStart: number, lineEnd: number, totalLines: number): void;
+export declare function validateResolvedPathWithinRoot(absolutePath: string, rootPath: string, options?: PathValidationOptions): Promise<string>;

package/dist/server/common/validation/path-validation.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validatePathWithinRoot = validatePathWithinRoot;
+exports.validateLineBounds = validateLineBounds;
+exports.validateResolvedPathWithinRoot = validateResolvedPathWithinRoot;
+const path_1 = require("path");
+const promises_1 = require("fs/promises");
+const error_types_1 = require("../errors/error-types");
+function validatePathWithinRoot(rootPath, filePath, options = {}) {
+    const errorPrefix = options.errorPrefix ?? 'Path validation failed';
+    if (!filePath || typeof filePath !== 'string') {
+        throw new error_types_1.ValidationError(`${errorPrefix}: File path is required`, {
+            filePath,
+            rootPath,
+        });
+    }
+    if ((0, path_1.isAbsolute)(filePath)) {
+        throw new error_types_1.ValidationError(`${errorPrefix}: Absolute paths are not allowed`, {
+            filePath,
+            rootPath,
+            reason: 'absolute_path',
+        });
+    }
+    if (filePath.startsWith('/') || filePath.startsWith('\\')) {
+        throw new error_types_1.ValidationError(`${errorPrefix}: Path cannot start with path separator`, {
+            filePath,
+            rootPath,
+            reason: 'leading_separator',
+        });
+    }
+    const normalizedPath = (0, path_1.normalize)(filePath);
+    const segments = normalizedPath.split(path_1.sep);
+    if (segments.includes('..')) {
+        throw new error_types_1.ValidationError(`${errorPrefix}: Path traversal sequences (..) are not allowed`, {
+            filePath,
+            normalizedPath,
+            rootPath,
+            reason: 'path_traversal',
+        });
+    }
+    if (normalizedPath.includes('../') || normalizedPath.includes('..\\')) {
+        throw new error_types_1.ValidationError(`${errorPrefix}: Path traversal sequences (..) are not allowed`, {
+            filePath,
+            normalizedPath,
+            rootPath,
+            reason: 'path_traversal',
+        });
+    }
+    const resolvedRoot = (0, path_1.resolve)(rootPath);
+    const absolutePath = (0, path_1.resolve)(resolvedRoot, normalizedPath);
+    const relativePath = (0, path_1.relative)(resolvedRoot, absolutePath);
+    if (relativePath.startsWith('..')) {
+        throw new error_types_1.ValidationError(`${errorPrefix}: Path escapes the root directory`, {
+            filePath,
+            absolutePath,
+            rootPath: resolvedRoot,
+            relativePath,
+            reason: 'escapes_root',
+        });
+    }
+    if ((0, path_1.isAbsolute)(relativePath)) {
+        throw new error_types_1.ValidationError(`${errorPrefix}: Path is on a different drive or mount`, {
+            filePath,
+            absolutePath,
+            rootPath: resolvedRoot,
+            relativePath,
+            reason: 'different_mount',
+        });
+    }
+    const rootWithSep = resolvedRoot.endsWith(path_1.sep) ? resolvedRoot : resolvedRoot + path_1.sep;
+    if (!absolutePath.startsWith(rootWithSep) && absolutePath !== resolvedRoot) {
+        throw new error_types_1.ValidationError(`${errorPrefix}: Resolved path is outside root directory`, {
+            filePath,
+            absolutePath,
+            rootPath: resolvedRoot,
+            reason: 'outside_root',
+        });
+    }
+    return {
+        absolutePath,
+        relativePath,
+    };
+}
+function validateLineBounds(lineStart, lineEnd, totalLines) {
+    if (!Number.isInteger(lineStart) || lineStart < 1) {
+        throw new error_types_1.ValidationError('Line start must be a positive integer', {
+            lineStart,
+            lineEnd,
+            totalLines,
+        });
+    }
+    if (!Number.isInteger(lineEnd) || lineEnd < 1) {
+        throw new error_types_1.ValidationError('Line end must be a positive integer', {
+            lineStart,
+            lineEnd,
+            totalLines,
+        });
+    }
+    if (lineEnd < lineStart) {
+        throw new error_types_1.ValidationError('Line end cannot be less than line start', {
+            lineStart,
+            lineEnd,
+            totalLines,
+        });
+    }
+    if (lineStart > totalLines) {
+        throw new error_types_1.ValidationError('Line start exceeds file length', {
+            lineStart,
+            lineEnd,
+            totalLines,
+        });
+    }
+    if (lineEnd > totalLines) {
+        throw new error_types_1.ValidationError('Line end exceeds file length', {
+            lineStart,
+            lineEnd,
+            totalLines,
+        });
+    }
+}
+async function validateResolvedPathWithinRoot(absolutePath, rootPath, options = {}) {
+    const errorPrefix = options.errorPrefix ?? 'Symlink validation failed';
+    const resolvedRoot = (0, path_1.resolve)(rootPath);
+    const assertWithinRoot = (pathToCheck) => {
+        const rootWithSep = resolvedRoot.endsWith(path_1.sep) ? resolvedRoot : resolvedRoot + path_1.sep;
+        if (!pathToCheck.startsWith(rootWithSep) && pathToCheck !== resolvedRoot) {
+            throw new error_types_1.ValidationError(`${errorPrefix}: Symlink escapes the root directory`, {
+                path: absolutePath,
+                realPath: pathToCheck,
+                rootPath: resolvedRoot,
+                reason: 'symlink_escape',
+            });
+        }
+        const relativePath = (0, path_1.relative)(resolvedRoot, pathToCheck);
+        if (relativePath.startsWith('..') || (0, path_1.isAbsolute)(relativePath)) {
+            throw new error_types_1.ValidationError(`${errorPrefix}: Symlink target is outside root directory`, {
+                path: absolutePath,
+                realPath: pathToCheck,
+                rootPath: resolvedRoot,
+                relativePath,
+                reason: 'symlink_escape',
+            });
+        }
+    };
+    let isSymlink = false;
+    try {
+        const stats = await (0, promises_1.lstat)(absolutePath);
+        isSymlink = stats.isSymbolicLink();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+        }
+        else {
+            throw error;
+        }
+    }
+    try {
+        const realPath = await (0, promises_1.realpath)(absolutePath);
+        assertWithinRoot(realPath);
+        return realPath;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+        if (isSymlink) {
+            throw new error_types_1.ValidationError(`${errorPrefix}: Symlink target does not exist`, {
+                path: absolutePath,
+                rootPath: resolvedRoot,
+                reason: 'symlink_target_missing',
+            });
+        }
+        if (options.allowNonExistent) {
+            let current = (0, path_1.dirname)(absolutePath);
+            while (true) {
+                try {
+                    const resolvedAncestor = await (0, promises_1.realpath)(current);
+                    const tail = (0, path_1.relative)(current, absolutePath);
+                    const candidatePath = (0, path_1.resolve)(resolvedAncestor, tail);
+                    assertWithinRoot(candidatePath);
+                    return candidatePath;
+                }
+                catch (ancestorError) {
+                    if (ancestorError.code !== 'ENOENT') {
+                        throw ancestorError;
+                    }
+                    const parent = (0, path_1.dirname)(current);
+                    if (parent === current)
+                        break;
+                    current = parent;
+                }
+            }
+        }
+        return absolutePath;
+    }
+}
+//# sourceMappingURL=path-validation.js.map

package/dist/server/common/validation/path-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validation.js","sourceRoot":"","sources":["../../../src/common/validation/path-validation.ts"],"names":[],"mappings":";;AAsDA,wDA2GC;AAUD,gDAwCC;AAoBD,wEAyFC;AAhUD,+BAA8E;AAC9E,0CAA8C;AAC9C,uDAAwD;AAoDxD,SAAgB,sBAAsB,CACpC,QAAgB,EAChB,QAAgB,EAChB,UAAiC,EAAE;IAEnC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,wBAAwB,CAAC;IAGpE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,yBAAyB,EAAE;YACjE,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,IAAA,iBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,kCAAkC,EAAE;YAC1E,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,yCAAyC,EAAE;YACjF,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,mBAAmB;SAC5B,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,cAAc,GAAG,IAAA,gBAAS,EAAC,QAAQ,CAAC,CAAC;IAI3C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,UAAG,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,iDAAiD,EAAE;YACzF,QAAQ;YACR,cAAc;YACd,QAAQ;YACR,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,iDAAiD,EAAE;YACzF,QAAQ;YACR,cAAc;YACd,QAAQ;YACR,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,QAAQ,CAAC,CAAC;IAGvC,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAI3D,MAAM,YAAY,GAAG,IAAA,eAAQ,EAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAG1D,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,mCAAmC,EAAE;YAC3E,QAAQ;YACR,YAAY;YACZ,QAAQ,EAAE,YAAY;YACtB,YAAY;YACZ,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,IAAA,iBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,yCAAyC,EAAE;YACjF,QAAQ;YACR,YAAY;YACZ,QAAQ,EAAE,YAAY;YACtB,YAAY;YACZ,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;IACL,CAAC;IAKD,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,GAAG,UAAG,CAAC;IACnF,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAC3E,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,2CAA2C,EAAE;YACnF,QAAQ;YACR,YAAY;YACZ,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,YAAY;QACZ,YAAY;KACb,CAAC;AACJ,CAAC;AAUD,SAAgB,kBAAkB,CAAC,SAAiB,EAAE,OAAe,EAAE,UAAkB;IACvF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,6BAAe,CAAC,uCAAuC,EAAE;YACjE,SAAS;YACT,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,6BAAe,CAAC,qCAAqC,EAAE;YAC/D,SAAS;YACT,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6BAAe,CAAC,yCAAyC,EAAE;YACnE,SAAS;YACT,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,IAAI,SAAS,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,6BAAe,CAAC,gCAAgC,EAAE;YAC1D,SAAS;YACT,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,6BAAe,CAAC,8BAA8B,EAAE;YACxD,SAAS;YACT,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAoBM,KAAK,UAAU,8BAA8B,CAClD,YAAoB,EACpB,QAAgB,EAChB,UAAiC,EAAE;IAEnC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,2BAA2B,CAAC;IACvE,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,QAAQ,CAAC,CAAC;IAEvC,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAE,EAAE;QAC/C,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,GAAG,UAAG,CAAC;QACnF,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACzE,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,sCAAsC,EAAE;gBAC9E,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,eAAQ,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAA,iBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,4CAA4C,EAAE;gBACpF,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,YAAY;gBACtB,YAAY;gBACZ,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAGF,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAA,gBAAK,EAAC,YAAY,CAAC,CAAC;QACxC,SAAS,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAGzD,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAQ,EAAC,YAAY,CAAC,CAAC;QAC9C,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;QAGD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,6BAAe,CAAC,GAAG,WAAW,iCAAiC,EAAE;gBACzE,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;QACL,CAAC;QAID,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,IAAI,OAAO,GAAG,IAAA,cAAO,EAAC,YAAY,CAAC,CAAC;YAEpC,OAAO,IAAI,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,gBAAgB,GAAG,MAAM,IAAA,mBAAQ,EAAC,OAAO,CAAC,CAAC;oBACjD,MAAM,IAAI,GAAG,IAAA,eAAQ,EAAC,OAAO,EAAE,YAAY,CAAC,CAAC;oBAC7C,MAAM,aAAa,GAAG,IAAA,cAAO,EAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;oBACtD,gBAAgB,CAAC,aAAa,CAAC,CAAC;oBAChC,OAAO,aAAa,CAAC;gBACvB,CAAC;gBAAC,OAAO,aAAa,EAAE,CAAC;oBACvB,IAAK,aAAuC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC/D,MAAM,aAAa,CAAC;oBACtB,CAAC;oBACD,MAAM,MAAM,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,CAAC;oBAChC,IAAI,MAAM,KAAK,OAAO;wBAAE,MAAM;oBAC9B,OAAO,GAAG,MAAM,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAGD,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/server/modules/chat/dtos/chat.dto.d.ts

@@ -25,8 +25,8 @@ export declare const CreateGroupThreadSchema: z.ZodObject<{
     projectId: string;
     agentIds: string[];
     title?: string | undefined;
-    createdByType?: "agent" | "user" | "system" | undefined;
     createdByAgentId?: string | undefined;
+    createdByType?: "agent" | "user" | "system" | undefined;
 }>;
 export declare const InviteThreadMembersSchema: z.ZodObject<{
     agentIds: z.ZodArray<z.ZodString, "many">;
@@ -126,10 +126,10 @@ export declare const ThreadSchema: z.ZodObject<{
     updatedAt: string;
     projectId: string;
     title: string | null;
+    createdByAgentId: string | null;
     isGroup: boolean;
     createdByType: "agent" | "user" | "system";
     createdByUserId: string | null;
-    createdByAgentId: string | null;
     members?: string[] | undefined;
 }, {
     id: string;
@@ -137,10 +137,10 @@ export declare const ThreadSchema: z.ZodObject<{
     updatedAt: string;
     projectId: string;
     title: string | null;
+    createdByAgentId: string | null;
     isGroup: boolean;
     createdByType: "agent" | "user" | "system";
     createdByUserId: string | null;
-    createdByAgentId: string | null;
     members?: string[] | undefined;
 }>;
 export declare const MessageSchema: z.ZodObject<{
@@ -155,17 +155,17 @@ export declare const MessageSchema: z.ZodObject<{
     content: string;
     id: string;
     createdAt: string;
-    threadId: string;
     authorType: "agent" | "user" | "system";
     authorAgentId: string | null;
+    threadId: string;
     targets?: string[] | undefined;
 }, {
     content: string;
     id: string;
     createdAt: string;
-    threadId: string;
     authorType: "agent" | "user" | "system";
     authorAgentId: string | null;
+    threadId: string;
     targets?: string[] | undefined;
 }>;
 export declare const ThreadsListSchema: z.ZodObject<{
@@ -186,10 +186,10 @@ export declare const ThreadsListSchema: z.ZodObject<{
         updatedAt: string;
         projectId: string;
         title: string | null;
+        createdByAgentId: string | null;
         isGroup: boolean;
         createdByType: "agent" | "user" | "system";
         createdByUserId: string | null;
-        createdByAgentId: string | null;
         members?: string[] | undefined;
     }, {
         id: string;
@@ -197,10 +197,10 @@ export declare const ThreadsListSchema: z.ZodObject<{
         updatedAt: string;
         projectId: string;
         title: string | null;
+        createdByAgentId: string | null;
         isGroup: boolean;
         createdByType: "agent" | "user" | "system";
         createdByUserId: string | null;
-        createdByAgentId: string | null;
         members?: string[] | undefined;
     }>, "many">;
     total: z.ZodNumber;
@@ -215,10 +215,10 @@ export declare const ThreadsListSchema: z.ZodObject<{
         updatedAt: string;
         projectId: string;
         title: string | null;
+        createdByAgentId: string | null;
         isGroup: boolean;
         createdByType: "agent" | "user" | "system";
         createdByUserId: string | null;
-        createdByAgentId: string | null;
         members?: string[] | undefined;
     }[];
     total: number;
@@ -231,10 +231,10 @@ export declare const ThreadsListSchema: z.ZodObject<{
         updatedAt: string;
         projectId: string;
         title: string | null;
+        createdByAgentId: string | null;
         isGroup: boolean;
         createdByType: "agent" | "user" | "system";
         createdByUserId: string | null;
-        createdByAgentId: string | null;
         members?: string[] | undefined;
     }[];
     total: number;
@@ -252,17 +252,17 @@ export declare const MessagesListSchema: z.ZodObject<{
         content: string;
         id: string;
         createdAt: string;
-        threadId: string;
         authorType: "agent" | "user" | "system";
         authorAgentId: string | null;
+        threadId: string;
         targets?: string[] | undefined;
     }, {
         content: string;
         id: string;
         createdAt: string;
-        threadId: string;
         authorType: "agent" | "user" | "system";
         authorAgentId: string | null;
+        threadId: string;
         targets?: string[] | undefined;
     }>, "many">;
     total: z.ZodNumber;
@@ -275,9 +275,9 @@ export declare const MessagesListSchema: z.ZodObject<{
         content: string;
         id: string;
         createdAt: string;
-        threadId: string;
         authorType: "agent" | "user" | "system";
         authorAgentId: string | null;
+        threadId: string;
         targets?: string[] | undefined;
     }[];
     total: number;
@@ -288,9 +288,9 @@ export declare const MessagesListSchema: z.ZodObject<{
         content: string;
         id: string;
         createdAt: string;
-        threadId: string;
         authorType: "agent" | "user" | "system";
         authorAgentId: string | null;
+        threadId: string;
         targets?: string[] | undefined;
     }[];
     total: number;

package/dist/server/modules/core/core.module.js

@@ -11,6 +11,7 @@ const common_1 = require("@nestjs/common");
 const health_controller_1 = require("./controllers/health.controller");
 const preflight_controller_1 = require("./controllers/preflight.controller");
 const preflight_service_1 = require("./services/preflight.service");
+const provider_mcp_ensure_service_1 = require("./services/provider-mcp-ensure.service");
 const storage_module_1 = require("../storage/storage.module");
 const mcp_module_1 = require("../mcp/mcp.module");
 const adapters_1 = require("../providers/adapters");
@@ -21,8 +22,8 @@ exports.CoreModule = CoreModule = __decorate([
     (0, common_1.Module)({
         imports: [storage_module_1.StorageModule, (0, common_1.forwardRef)(() => mcp_module_1.McpModule), adapters_1.ProviderAdaptersModule],
         controllers: [health_controller_1.HealthController, preflight_controller_1.PreflightController],
-        providers: [preflight_service_1.PreflightService],
-        exports: [preflight_service_1.PreflightService],
+        providers: [preflight_service_1.PreflightService, provider_mcp_ensure_service_1.ProviderMcpEnsureService],
+        exports: [preflight_service_1.PreflightService, provider_mcp_ensure_service_1.ProviderMcpEnsureService],
     })
 ], CoreModule);
 //# sourceMappingURL=core.module.js.map

package/dist/server/modules/core/core.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.module.js","sourceRoot":"","sources":["../../../src/modules/core/core.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAoD;AACpD,uEAAmE;AACnE,6EAAyE;AACzE,oEAAgE;AAChE,8DAA0D;AAC1D,kDAA8C;AAC9C,oDAA+D;AAQxD,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IANtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,8BAAa,EAAE,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,sBAAS,CAAC,EAAE,iCAAsB,CAAC;QAC7E,WAAW,EAAE,CAAC,oCAAgB,EAAE,0CAAmB,CAAC;QACpD,SAAS,EAAE,CAAC,oCAAgB,CAAC;QAC7B,OAAO,EAAE,CAAC,oCAAgB,CAAC;KAC5B,CAAC;GACW,UAAU,CAAG"}
+{"version":3,"file":"core.module.js","sourceRoot":"","sources":["../../../src/modules/core/core.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAoD;AACpD,uEAAmE;AACnE,6EAAyE;AACzE,oEAAgE;AAChE,wFAAkF;AAClF,8DAA0D;AAC1D,kDAA8C;AAC9C,oDAA+D;AAQxD,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IANtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,8BAAa,EAAE,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,sBAAS,CAAC,EAAE,iCAAsB,CAAC;QAC7E,WAAW,EAAE,CAAC,oCAAgB,EAAE,0CAAmB,CAAC;QACpD,SAAS,EAAE,CAAC,oCAAgB,EAAE,sDAAwB,CAAC;QACvD,OAAO,EAAE,CAAC,oCAAgB,EAAE,sDAAwB,CAAC;KACtD,CAAC;GACW,UAAU,CAAG"}

package/dist/server/modules/core/services/preflight.service.d.ts

@@ -33,8 +33,6 @@ export declare class PreflightService {
     private readonly storage;
     private readonly mcpRegistration;
     private readonly adapterFactory;
-    private cache;
-    private readonly CACHE_TTL_MS;
     constructor(storage: StorageService, mcpRegistration: McpProviderRegistrationService, adapterFactory: ProviderAdapterFactory);
     runChecks(projectPath?: string): Promise<PreflightResult>;
     private evaluateMcpStatus;
@@ -43,5 +41,5 @@ export declare class PreflightService {
     private checkProvider;
     private checkDevchainAccess;
     getCheck(checkName: string, projectPath?: string): Promise<PreflightCheck>;
-    clearCache(projectPath?: string): void;
+    clearCache(_projectPath?: string): void;
 }