mstro-app 0.4.50 → 0.4.52

package/server/services/websocket/file-upload-handler.ts

@@ -4,13 +4,16 @@
 /**
  * Chunked File Upload Handler
  *
- * Receives files in chunks over WebSocket from remote web clients,
- * writes them to .mstro/tmp/attachments/{tabId}/, and sends progress acks back.
+ * Receives files in chunks over WebSocket from remote web clients.
+ * - When `targetPath` is provided: streams to <workingDir>/<targetPath> (drag-drop into file tree).
+ * - Otherwise: streams to .mstro/tmp/attachments/{tabId}/ (prompt attachments).
  */
 
 import type { WriteStream } from 'node:fs';
 import { createWriteStream, existsSync, mkdirSync, rmSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
+import { containsDangerousPatterns, validatePathWithinWorkingDir } from '../pathUtils.js';
+import type { HandlerContext } from './handler-context.js';
 import type { WebSocketResponse, WSContext } from './types.js';
 
 interface UploadState {
@@ -22,6 +25,8 @@ interface UploadState {
   totalChunks: number;
   receivedChunks: number;
   filePath: string;
+  /** Path relative to workingDir (only set when destination is the file tree, not the attachments dir) */
+  targetRelPath?: string;
   stream: WriteStream;
   lastActivity: number;
 }
@@ -44,7 +49,10 @@ export class FileUploadHandler {
   private completedUploads = new Map<string, CompletedUpload[]>(); // tabId -> completed uploads
   private cleanupInterval: ReturnType<typeof setInterval>;
 
-  constructor(private workingDir: string) {
+  constructor(
+    private workingDir: string,
+    private ctx?: HandlerContext,
+  ) {
     // Periodically clean up stale uploads
     this.cleanupInterval = setInterval(() => this.cleanupStaleUploads(), 30_000);
   }
@@ -65,59 +73,48 @@ export class FileUploadHandler {
     ws: WSContext,
     send: (ws: WSContext, response: WebSocketResponse) => void,
     tabId: string,
-    data: { uploadId: string; fileName: string; fileSize: number; mimeType: string; isImage: boolean; totalChunks: number }
+    data: { uploadId: string; fileName: string; fileSize: number; mimeType: string; isImage: boolean; totalChunks: number; targetPath?: string; overwrite?: boolean },
+    permission?: 'view',
   ): void {
-    const { uploadId, fileName, fileSize, mimeType, isImage, totalChunks } = data;
+    const { uploadId, fileName, fileSize, mimeType, isImage, totalChunks, targetPath, overwrite } = data;
+    const sendError = (error: string) => send(ws, {
+      type: 'fileUploadError' as WebSocketResponse['type'],
+      tabId,
+      data: { uploadId, error },
+    });
 
-    // Validate file size
     if (fileSize > MAX_FILE_SIZE) {
-      send(ws, {
-        type: 'fileUploadError' as WebSocketResponse['type'],
-        tabId,
-        data: { uploadId, error: `File too large: ${(fileSize / 1024 / 1024).toFixed(1)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit` }
-      });
+      sendError(`File too large: ${(fileSize / 1024 / 1024).toFixed(1)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit`);
       return;
     }
 
-    // Create attachment directory
-    const attachDir = join(this.workingDir, '.mstro', 'tmp', 'attachments', tabId);
-    if (!existsSync(attachDir)) {
-      mkdirSync(attachDir, { recursive: true });
-    }
+    const resolved = targetPath !== undefined
+      ? resolveFileTreeTarget({ targetPath, fileName, workingDir: this.workingDir, permission, overwrite })
+      : resolveAttachmentTarget({ workingDir: this.workingDir, tabId, fileName });
 
-    // Handle duplicate file names
-    let targetFileName = fileName;
-    let counter = 1;
-    while (existsSync(join(attachDir, targetFileName))) {
-      const ext = fileName.lastIndexOf('.') !== -1 ? fileName.slice(fileName.lastIndexOf('.')) : '';
-      const base = fileName.lastIndexOf('.') !== -1 ? fileName.slice(0, fileName.lastIndexOf('.')) : fileName;
-      targetFileName = `${base}-${counter}${ext}`;
-      counter++;
+    if (!resolved.ok) {
+      sendError(resolved.error);
+      return;
     }
 
-    const filePath = join(attachDir, targetFileName);
-    const stream = createWriteStream(filePath);
-
-    const uploadState: UploadState = {
+    this.activeUploads.set(uploadId, {
       uploadId,
-      fileName: targetFileName,
+      fileName: resolved.fileName,
       fileSize,
       mimeType,
       isImage,
       totalChunks,
       receivedChunks: 0,
-      filePath,
-      stream,
+      filePath: resolved.filePath,
+      targetRelPath: resolved.targetRelPath,
+      stream: createWriteStream(resolved.filePath),
       lastActivity: Date.now(),
-    };
-
-    this.activeUploads.set(uploadId, uploadState);
+    });
 
-    // Send ack for start
     send(ws, {
       type: 'fileUploadAck' as WebSocketResponse['type'],
       tabId,
-      data: { uploadId, chunkIndex: -1, status: 'ok' }
+      data: { uploadId, chunkIndex: -1, status: 'ok' },
     });
   }
 
@@ -183,27 +180,50 @@ export class FileUploadHandler {
       // Verify file was written
       try {
         const stat = statSync(upload.filePath);
-        const completed: CompletedUpload = {
-          uploadId,
-          fileName: upload.fileName,
-          filePath: upload.filePath,
-          isImage: upload.isImage,
-          mimeType: upload.mimeType,
-          fileSize: stat.size,
-        };
-
-        // Store completed upload for this tab
-        const tabUploads = this.completedUploads.get(tabId) || [];
-        tabUploads.push(completed);
-        this.completedUploads.set(tabId, tabUploads);
+
+        // Only stash as a pending prompt attachment for the attachment-path case.
+        // File-tree drops land at the final destination directly.
+        if (upload.targetRelPath === undefined) {
+          const completed: CompletedUpload = {
+            uploadId,
+            fileName: upload.fileName,
+            filePath: upload.filePath,
+            isImage: upload.isImage,
+            mimeType: upload.mimeType,
+            fileSize: stat.size,
+          };
+          const tabUploads = this.completedUploads.get(tabId) || [];
+          tabUploads.push(completed);
+          this.completedUploads.set(tabId, tabUploads);
+        }
 
         this.activeUploads.delete(uploadId);
 
         send(ws, {
           type: 'fileUploadReady' as WebSocketResponse['type'],
           tabId,
-          data: { uploadId, filePath: upload.filePath, fileName: upload.fileName }
+          data: {
+            uploadId,
+            filePath: upload.filePath,
+            fileName: upload.fileName,
+            ...(upload.targetRelPath !== undefined ? { targetPath: upload.targetRelPath } : {}),
+          },
         });
+
+        // Broadcast fileCreated so all connected clients (including the uploader)
+        // refresh their file tree. The final path may differ from the requested
+        // targetPath due to counter-based disambiguation, so we broadcast the resolved path.
+        if (upload.targetRelPath !== undefined && this.ctx) {
+          this.ctx.broadcastToAll({
+            type: 'fileCreated' as WebSocketResponse['type'],
+            data: {
+              path: upload.targetRelPath,
+              name: upload.fileName,
+              size: stat.size,
+              modifiedAt: new Date().toISOString(),
+            },
+          });
+        }
       } catch (err) {
         const errorMsg = err instanceof Error ? err.message : String(err);
         send(ws, {
@@ -257,3 +277,91 @@ export class FileUploadHandler {
     }
   }
 }
+
+type ResolveResult =
+  | { ok: true; filePath: string; fileName: string; targetRelPath?: string }
+  | { ok: false; error: string };
+
+function splitExt(fileName: string): { base: string; ext: string } {
+  const dot = fileName.lastIndexOf('.');
+  if (dot <= 0) return { base: fileName, ext: '' };
+  return { base: fileName.slice(0, dot), ext: fileName.slice(dot) };
+}
+
+function ensureDir(dir: string): void {
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+}
+
+function resolveFileTreeTarget(opts: {
+  targetPath: string;
+  fileName: string;
+  workingDir: string;
+  permission?: 'view';
+  overwrite?: boolean;
+}): ResolveResult {
+  const { targetPath, fileName, workingDir, permission, overwrite } = opts;
+
+  if (permission === 'view') {
+    return { ok: false, error: 'View-only sessions cannot upload files' };
+  }
+  if (containsDangerousPatterns(targetPath) || containsDangerousPatterns(fileName)) {
+    return { ok: false, error: 'Invalid characters in target path' };
+  }
+
+  const validation = validatePathWithinWorkingDir(targetPath, workingDir);
+  if (!validation.valid) {
+    return { ok: false, error: validation.error ?? 'Invalid target path' };
+  }
+
+  const resolvedPath = validation.resolvedPath;
+  const parent = dirname(resolvedPath);
+  try {
+    ensureDir(parent);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, error: `Failed to create parent directory: ${msg}` };
+  }
+
+  const lastSlash = targetPath.lastIndexOf('/');
+  const relDir = lastSlash >= 0 ? targetPath.slice(0, lastSlash) : '';
+
+  let finalName = fileName;
+  let finalAbs = resolvedPath;
+  if (existsSync(finalAbs) && !overwrite) {
+    const { base, ext } = splitExt(fileName);
+    let counter = 1;
+    do {
+      finalName = `${base} (${counter})${ext}`;
+      finalAbs = join(parent, finalName);
+      counter++;
+    } while (existsSync(finalAbs));
+  }
+
+  const finalRel = relDir ? `${relDir}/${finalName}` : finalName;
+  return { ok: true, filePath: finalAbs, fileName: finalName, targetRelPath: finalRel };
+}
+
+function resolveAttachmentTarget(opts: {
+  workingDir: string;
+  tabId: string;
+  fileName: string;
+}): ResolveResult {
+  const { workingDir, tabId, fileName } = opts;
+  const attachDir = join(workingDir, '.mstro', 'tmp', 'attachments', tabId);
+  try {
+    ensureDir(attachDir);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, error: `Failed to create attachment directory: ${msg}` };
+  }
+
+  let finalName = fileName;
+  let counter = 1;
+  while (existsSync(join(attachDir, finalName))) {
+    const { base, ext } = splitExt(fileName);
+    finalName = `${base}-${counter}${ext}`;
+    counter++;
+  }
+
+  return { ok: true, filePath: join(attachDir, finalName), fileName: finalName };
+}

package/server/services/websocket/git-branch-handlers.ts

@@ -2,6 +2,7 @@
 // Licensed under the MIT License. See LICENSE file for details.
 
 import { executeGitCommand, sendGitError } from './git-utils.js';
+import { findWorktreePathForBranch, handleTabWorktreeSwitch } from './git-worktree-handlers.js';
 import type { HandlerContext } from './handler-context.js';
 import type { GitBranchEntry, WebSocketMessage, WSContext } from './types.js';
 
@@ -40,7 +41,28 @@ export async function handleGitListBranches(ctx: HandlerContext, ws: WSContext,
   }
 }
 
-export async function handleGitCheckout(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string): Promise<void> {
+/**
+ * If `branch` is already checked out in a worktree other than `workingDir`, redirect the tab
+ * there via the worktree-switch flow and return true. Git refuses `checkout` in this case, so
+ * treating it as a view change is both correct and the only thing that works.
+ */
+async function redirectToWorktreeIfBranchCheckedOut(
+  ctx: HandlerContext, ws: WSContext,
+  tabId: string, branch: string, workingDir: string, rootWorkingDir: string,
+): Promise<boolean> {
+  const wtListResult = await executeGitCommand(['worktree', 'list', '--porcelain'], workingDir);
+  if (wtListResult.exitCode !== 0) return false;
+  const existingWt = findWorktreePathForBranch(wtListResult.stdout, branch);
+  if (!existingWt || existingWt === workingDir) return false;
+  await handleTabWorktreeSwitch(
+    ctx, ws,
+    { type: 'tabWorktreeSwitch', tabId, data: { tabId, worktreePath: existingWt } },
+    tabId, rootWorkingDir,
+  );
+  return true;
+}
+
+export async function handleGitCheckout(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string, rootWorkingDir: string): Promise<void> {
   try {
     const { branch, create, startPoint } = msg.data || {};
     if (!branch) {
@@ -48,6 +70,11 @@ export async function handleGitCheckout(ctx: HandlerContext, ws: WSContext, msg:
       return;
     }
 
+    // Skip the worktree redirect for `create` — a name collision there is a real user error.
+    if (!create && await redirectToWorktreeIfBranchCheckedOut(ctx, ws, tabId, branch, workingDir, rootWorkingDir)) {
+      return;
+    }
+
     const statusResult = await executeGitCommand(['status', '--porcelain'], workingDir);
     if (statusResult.stdout.trim()) {
       ctx.send(ws, { type: 'gitError', tabId, data: { error: 'Commit or stash changes before switching branches' } });

package/server/services/websocket/git-handlers.ts

@@ -53,7 +53,7 @@ export async function handleGitMessage(ctx: HandlerContext, ws: WSContext, msg:
     gitDiscoverRepos: () => handleGitDiscoverRepos(ctx, ws, tabId, workingDir),
     gitSetDirectory: () => handleGitSetDirectory(ctx, ws, msg, tabId, workingDir),
     gitListBranches: () => handleGitListBranches(ctx, ws, tabId, gitDir),
-    gitCheckout: () => handleGitCheckout(ctx, ws, msg, tabId, gitDir),
+    gitCheckout: () => handleGitCheckout(ctx, ws, msg, tabId, gitDir, workingDir),
     gitCreateBranch: () => handleGitCreateBranch(ctx, ws, msg, tabId, gitDir),
     gitDeleteBranch: () => handleGitDeleteBranch(ctx, ws, msg, tabId, gitDir),
     gitDiff: () => handleGitDiff(ctx, ws, msg, tabId, gitDir),

package/server/services/websocket/git-worktree-handlers.ts

@@ -201,7 +201,7 @@ async function handleGitWorktreeRemove(ctx: HandlerContext, ws: WSContext, msg:
   }
 }
 
-async function handleTabWorktreeSwitch(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string): Promise<void> {
+export async function handleTabWorktreeSwitch(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string): Promise<void> {
   try {
     const { tabId: targetTabId, worktreePath } = msg.data || {};
     const resolvedTabId = targetTabId || tabId;
@@ -445,7 +445,7 @@ async function cleanupAfterMerge(
   return { warnings, removedWorktreePath };
 }
 
-function findWorktreePathForBranch(porcelainOutput: string, branchName: string): string | null {
+export function findWorktreePathForBranch(porcelainOutput: string, branchName: string): string | null {
   let currentWtPath = '';
   const fullRef = `refs/heads/${branchName}`;
   for (const line of porcelainOutput.split('\n')) {

package/server/services/websocket/handler.ts

@@ -220,20 +220,20 @@ export class WebSocketImproviseHandler implements HandlerContext {
       case 'git':        return handleGitMessage(this, ws, msg, tabId, workingDir);
       case 'quality':    return handleQualityMessage(this, ws, msg, tabId, workingDir, permission);
       case 'plan':       return handlePlanMessage(this, ws, msg, tabId, workingDir, permission);
-      case 'fileUpload': return this.handleFileUploadMessage(ws, msg, tabId, workingDir);
+      case 'fileUpload': return this.handleFileUploadMessage(ws, msg, tabId, workingDir, permission);
     }
   }
 
-  private handleFileUploadMessage(ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string): void {
+  private handleFileUploadMessage(ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string, permission?: 'view'): void {
     if (!this.fileUploadHandler) {
-      this.fileUploadHandler = new FileUploadHandler(workingDir);
+      this.fileUploadHandler = new FileUploadHandler(workingDir, this);
     }
     const handler = this.fileUploadHandler;
     const send = this.send.bind(this);
 
     switch (msg.type) {
       case 'fileUploadStart':
-        handler.handleUploadStart(ws, send, tabId, msg.data);
+        handler.handleUploadStart(ws, send, tabId, msg.data, permission);
         break;
       case 'fileUploadChunk':
         handler.handleUploadChunk(ws, send, tabId, msg.data);

package/server/services/websocket/plan-board-handlers.ts

@@ -209,6 +209,48 @@ export function handleArchiveBoard(
   }
 }
 
+export function handleRestoreBoard(
+  ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
+  workingDir: string, permission?: 'view',
+): void {
+  if (denyIfViewOnly(ctx, ws, permission)) return;
+
+  const boardId = msg.data?.boardId;
+  if (!boardId) {
+    ctx.send(ws, { type: 'planError', data: { error: 'Board ID required' } });
+    return;
+  }
+
+  const pmDir = resolvePmDir(workingDir);
+  if (!pmDir) return;
+
+  const boardMdPath = join(pmDir, 'boards', boardId, 'board.md');
+  if (!existsSync(boardMdPath)) {
+    ctx.send(ws, { type: 'planError', data: { error: `Board not found: ${boardId}` } });
+    return;
+  }
+
+  let content = readFileSync(boardMdPath, 'utf-8');
+  content = replaceFrontMatterField(content, 'status', 'active');
+  writeFileSync(boardMdPath, content, 'utf-8');
+
+  const workspacePath = join(pmDir, 'workspace.json');
+  if (existsSync(workspacePath)) {
+    const workspace: Workspace = JSON.parse(readFileSync(workspacePath, 'utf-8'));
+    if (!workspace.boardOrder.includes(boardId)) {
+      workspace.boardOrder.push(boardId);
+    }
+    workspace.activeBoardId = boardId;
+    writeFileSync(workspacePath, JSON.stringify(workspace, null, 2), 'utf-8');
+    ctx.broadcastToAll({ type: 'planWorkspaceUpdated', data: workspace });
+  }
+
+  const boardState = parseBoardDirectory(pmDir, boardId);
+  if (boardState) {
+    ctx.broadcastToAll({ type: 'planBoardUpdated', data: boardState.board });
+  }
+}
+
 export function handleGetBoard(
   ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage,
   workingDir: string,

package/server/services/websocket/plan-handlers.ts

@@ -9,7 +9,7 @@
  */
 
 import type { HandlerContext } from './handler-context.js';
-import { handleArchiveBoard, handleChatToBoard, handleCreateBoard, handleGetBoard, handleGetBoardArtifacts, handleGetBoardState, handleReorderBoards, handleSetActiveBoard, handleUpdateBoard } from './plan-board-handlers.js';
+import { handleArchiveBoard, handleChatToBoard, handleCreateBoard, handleGetBoard, handleGetBoardArtifacts, handleGetBoardState, handleReorderBoards, handleRestoreBoard, handleSetActiveBoard, handleUpdateBoard } from './plan-board-handlers.js';
 import { handleExecute, handleExecuteEpic, handlePause, handlePrompt, handleResume, handleStop } from './plan-execution-handlers.js';
 import { handleCreateIssue, handleDeleteIssue, handleGetIssue, handleGetMilestone, handleGetSprint, handleListIssues, handlePlanInit, handleScaffold, handleUpdateIssue } from './plan-issue-handlers.js';
 import { handleActivateSprint, handleCompleteSprint, handleCreateSprint, handleGetSprintArtifacts } from './plan-sprint-handlers.js';
@@ -47,6 +47,7 @@ export function handlePlanMessage(
     planCreateBoard: () => handleCreateBoard(ctx, ws, msg, workingDir, permission),
     planUpdateBoard: () => handleUpdateBoard(ctx, ws, msg, workingDir, permission),
     planArchiveBoard: () => handleArchiveBoard(ctx, ws, msg, workingDir, permission),
+    planRestoreBoard: () => handleRestoreBoard(ctx, ws, msg, workingDir, permission),
     planGetBoard: () => handleGetBoard(ctx, ws, msg, workingDir),
     planGetBoardState: () => handleGetBoardState(ctx, ws, msg, workingDir),
     planReorderBoards: () => handleReorderBoards(ctx, ws, msg, workingDir, permission),

package/server/services/websocket/types.ts

@@ -48,7 +48,7 @@ const FileUploadMessages = ['fileUploadStart', 'fileUploadChunk', 'fileUploadCom
 
 const PlanMessages = ['planInit', 'planGetState', 'planListIssues', 'planGetIssue', 'planGetSprint', 'planGetMilestone', 'planCreateIssue', 'planUpdateIssue', 'planDeleteIssue', 'planScaffold', 'planPrompt', 'planExecute', 'planExecuteEpic', 'planPause', 'planStop', 'planResume'] as const;
 
-const PlanBoardMessages = ['planCreateBoard', 'planUpdateBoard', 'planArchiveBoard', 'planGetBoard', 'planGetBoardState', 'planReorderBoards', 'planSetActiveBoard', 'planGetBoardArtifacts'] as const;
+const PlanBoardMessages = ['planCreateBoard', 'planUpdateBoard', 'planArchiveBoard', 'planRestoreBoard', 'planGetBoard', 'planGetBoardState', 'planReorderBoards', 'planSetActiveBoard', 'planGetBoardArtifacts'] as const;
 
 const PlanSprintMessages = ['planCreateSprint', 'planActivateSprint', 'planCompleteSprint', 'planGetSprintArtifacts'] as const;