mstro-app 0.5.0 → 0.5.1

package/server/services/platform-token-lifecycle.ts

@@ -0,0 +1,171 @@
+// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
+
+/**
+ * Token Lifecycle — refresh, verify, and auth-expired signaling for the
+ * platform device token. Extracted from PlatformConnection so the relay
+ * lifecycle (sockets, reconnect, heartbeat) and the auth lifecycle (token
+ * refresh, verify, expired-signal) can be reasoned about apart. The token
+ * lifecycle has its own clock (24h periodic check), its own remote endpoints
+ * (/refresh, /verify), and its own failure modes (revocation vs. transient
+ * network error) — none of which need to be in PlatformConnection.
+ */
+
+import {
+  getCredentials,
+  shouldRefreshToken,
+  updateCredentials,
+} from './platform-credentials.js'
+
+const PERIODIC_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000
+
+export interface TokenLifecycleDeps {
+  /** Platform base URL — used to compose /api/auth/device/{refresh,verify} */
+  platformUrl: string
+  /** Send a message upstream over the live relay socket (no-op if closed). */
+  send: (message: unknown) => void
+  /** Read the current relay connection ID at the moment auth-expired fires. */
+  getConnectionId: () => string | null
+}
+
+export class TokenLifecycle {
+  private intervalHandle: ReturnType<typeof setInterval> | null = null
+
+  constructor(private readonly deps: TokenLifecycleDeps) {}
+
+  /**
+   * Refresh the device token if it's older than the refresh interval.
+   * Returns `true` if the token is (still) valid after this call, `false`
+   * if refresh was attempted and rejected with an auth error — in which
+   * case the caller should surface an auth-expired signal to the web
+   * rather than silently reusing a dead token.
+   */
+  async maybeRefresh(): Promise<boolean> {
+    const creds = getCredentials()
+    if (!creds) return false
+    if (!shouldRefreshToken(creds)) return true
+
+    try {
+      const response = await fetch(`${this.deps.platformUrl}/api/auth/device/refresh`, {
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${creds.token}`,
+          'Content-Type': 'application/json'
+        }
+      })
+
+      if (response.ok) {
+        const data = await response.json() as { accessToken: string }
+        updateCredentials({
+          token: data.accessToken,
+          lastRefreshedAt: new Date().toISOString()
+        })
+        return true
+      }
+      if (response.status === 401 || response.status === 403) {
+        console.warn(`[Platform] Token refresh failed — auth is expired (${response.status}). Run \`mstro login --force\`.`)
+        this.notifyAuthExpired()
+        return false
+      }
+      console.warn(`[Platform] Token refresh failed with status ${response.status}, will retry later`)
+      return true
+    } catch (err) {
+      console.warn('[Platform] Token refresh error:', err)
+      return true
+    }
+  }
+
+  /**
+   * Verify the current token against the platform. A rejection (401/403)
+   * means the token is permanently invalid (revoked, signing-key rotation,
+   * account deleted); the caller should stop looping reconnects and tell
+   * the user to run `mstro login --force`.
+   *
+   * Returns `true` when the token is valid or the verification endpoint
+   * is unreachable (we prefer false negatives to false positives — a
+   * network blip shouldn't force a re-login).
+   */
+  async verify(): Promise<boolean> {
+    const creds = getCredentials()
+    if (!creds?.token) return false
+    try {
+      const response = await fetch(`${this.deps.platformUrl}/api/auth/device/verify`, {
+        method: 'POST',
+        headers: { 'Authorization': `Bearer ${creds.token}` },
+      })
+      if (response.status === 401 || response.status === 403) {
+        console.warn(`[Platform] Token verify rejected (${response.status}) — auth is expired.`)
+        return false
+      }
+      return true
+    } catch {
+      // Network error: treat as "probably valid" so a flaky connection
+      // doesn't force users to re-login. The WebSocket open itself will
+      // catch a truly bad token via the 4001 path.
+      return true
+    }
+  }
+
+  /**
+   * Surface an auth-expired condition to any paired web clients.
+   *
+   * Two cooperating paths deliver this signal — either alone is enough,
+   * both together cover every timing edge:
+   *
+   *   1. **CLI-initiated (this method):** we detected a 401 from the
+   *      `/refresh` or `/verify` endpoint *while the relay socket is
+   *      still open*. The injected `send` pushes the message upstream so
+   *      the server relays it to paired webs before the CLI closes.
+   *      A no-op if the socket is already closed.
+   *
+   *   2. **Server-initiated:** when the platform closes a CLI socket
+   *      with 4001 or 4008, `handleAuthClose` in `clientHandlers.ts`
+   *      broadcasts the same `clientAuthExpired` to paired webs. This
+   *      covers cases where the CLI never had a chance to detect the
+   *      rejection itself (e.g. token revoked while the socket was idle,
+   *      server-side token rotation).
+   *
+   * IMPORTANT: never route this through PlatformConnection's
+   * `onRelayedMessage` callback — that callback feeds INCOMING web→CLI
+   * requests into the local handler, which would treat
+   * `clientAuthExpired` as an unknown inbound request.
+   */
+  notifyAuthExpired(): void {
+    this.deps.send({
+      type: 'clientAuthExpired',
+      data: {
+        connectionId: this.deps.getConnectionId(),
+        message: 'The CLI\'s device token is invalid — run `mstro login --force` on the machine.',
+      },
+    })
+  }
+
+  /**
+   * Best-effort token verification, fired in parallel with the socket
+   * open so a slow verify endpoint never delays reconnect.
+   *
+   * Only runs when the token is stale enough that we'd be about to
+   * refresh anyway — keeps the hot path free of an extra network call.
+   * A truly-revoked token that slips past this check still hits 4001
+   * on the WebSocket, which also triggers `notifyAuthExpired`.
+   */
+  maybeVerifyInParallel(): void {
+    const creds = getCredentials()
+    if (!creds || !shouldRefreshToken(creds)) return
+    this.verify().then((valid) => {
+      if (!valid) this.notifyAuthExpired()
+    }).catch(() => { /* network error — rely on 4001 close path */ })
+  }
+
+  startPeriodicCheck(): void {
+    this.intervalHandle = setInterval(() => {
+      this.maybeRefresh()
+    }, PERIODIC_CHECK_INTERVAL_MS)
+  }
+
+  stopPeriodicCheck(): void {
+    if (this.intervalHandle) {
+      clearInterval(this.intervalHandle)
+      this.intervalHandle = null
+    }
+  }
+}

package/server/services/platform.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Platform Connection Service
@@ -14,12 +13,8 @@ import { arch, hostname, type } from 'node:os'
 import { basename } from 'node:path'
 import { AnalyticsEvents, trackEvent } from './analytics.js'
 import { getClientId } from './client-id.js'
-import {
-  CLI_VERSION,
-  getCredentials,
-  shouldRefreshToken,
-  updateCredentials,
-} from './platform-credentials.js'
+import { CLI_VERSION, getCredentials } from './platform-credentials.js'
+import { TokenLifecycle } from './platform-token-lifecycle.js'
 import { captureException } from './sentry.js'
 
 /**
@@ -50,6 +45,27 @@ if (typeof WebSocket !== 'undefined') {
 // PLATFORM_URL is set via --server / --dev flag in mstro.js
 const DEFAULT_PLATFORM_URL = process.env.PLATFORM_URL || 'https://api.mstro.app'
 
+/**
+ * Relay wire-format version this CLI speaks. Bumped by the server when the
+ * relay protocol changes incompatibly. Must match (or exceed) the server's
+ * `minProtocolVersion` in `server/src/relay/version-policy.ts` — when the
+ * server's floor moves above this value, the upgrade handshake returns 426
+ * and the CLI surfaces the upgrade message via `handleSocketClose`.
+ *
+ * This is a build-time constant, not user-configurable: a stale CLI must be
+ * told to upgrade rather than allowed to opt itself into compatibility.
+ */
+const PROTOCOL_VERSION = 1
+
+/**
+ * Long sentinel delay used after a 426 protocol-too-old close. The CLI
+ * auto-upgrades on the next `mstro` invocation, so a tight reconnect loop
+ * would just hammer the server with rejections that policy already decided
+ * to refuse. One hour is long enough to count as "stop", short enough that
+ * a forgotten foreground process eventually retries on its own.
+ */
+const PROTOCOL_UPGRADE_RECONNECT_DELAY_MS = 60 * 60 * 1000
+
 interface ConnectionCallbacks {
   onConnected?: (connectionId: string) => void
   onDisconnected?: () => void
@@ -73,11 +89,12 @@ export class PlatformConnection {
   private callbacks: ConnectionCallbacks
   private connectionId: string | null = null
   private isConnected = false
-  private tokenRefreshInterval: ReturnType<typeof setInterval> | null = null
   private heartbeatInterval: ReturnType<typeof setInterval> | null = null
   private missedPongs = 0
   private everConnected = false
+  private protocolUpgradeRequired = false
   private readonly startedAt: string
+  private readonly tokens: TokenLifecycle
 
   constructor(
     workingDirectory: string,
@@ -88,120 +105,13 @@ export class PlatformConnection {
     this.platformUrl = platformUrl || DEFAULT_PLATFORM_URL
     this.callbacks = callbacks
     this.startedAt = new Date().toISOString()
-  }
-
-  /**
-   * Refresh the device token if it's older than the refresh interval.
-   * Returns `true` if the token is (still) valid after this call, `false`
-   * if refresh was attempted and rejected with an auth error — in which
-   * case the caller should surface an auth-expired signal to the web
-   * rather than silently reusing a dead token.
-   */
-  private async maybeRefreshToken(): Promise<boolean> {
-    const creds = getCredentials()
-    if (!creds) return false
-    if (!shouldRefreshToken(creds)) return true
-
-    try {
-      const response = await fetch(`${this.platformUrl}/api/auth/device/refresh`, {
-        method: 'POST',
-        headers: {
-          'Authorization': `Bearer ${creds.token}`,
-          'Content-Type': 'application/json'
-        }
-      })
-
-      if (response.ok) {
-        const data = await response.json() as { accessToken: string }
-        updateCredentials({
-          token: data.accessToken,
-          lastRefreshedAt: new Date().toISOString()
-        })
-        return true
-      }
-      if (response.status === 401 || response.status === 403) {
-        console.warn(`[Platform] Token refresh failed — auth is expired (${response.status}). Run \`mstro login --force\`.`)
-        this.notifyAuthExpired()
-        return false
-      }
-      console.warn(`[Platform] Token refresh failed with status ${response.status}, will retry later`)
-      return true
-    } catch (err) {
-      console.warn('[Platform] Token refresh error:', err)
-      return true
-    }
-  }
-
-  /**
-   * Verify the current token against the platform. A rejection (401/403)
-   * means the token is permanently invalid (revoked, signing-key rotation,
-   * account deleted); the caller should stop looping reconnects and tell
-   * the user to run `mstro login --force`.
-   *
-   * Returns `true` when the token is valid or the verification endpoint
-   * is unreachable (we prefer false negatives to false positives — a
-   * network blip shouldn't force a re-login).
-   */
-  private async verifyToken(): Promise<boolean> {
-    const creds = getCredentials()
-    if (!creds?.token) return false
-    try {
-      const response = await fetch(`${this.platformUrl}/api/auth/device/verify`, {
-        method: 'POST',
-        headers: { 'Authorization': `Bearer ${creds.token}` },
-      })
-      if (response.status === 401 || response.status === 403) {
-        console.warn(`[Platform] Token verify rejected (${response.status}) — auth is expired.`)
-        return false
-      }
-      return true
-    } catch {
-      // Network error: treat as "probably valid" so a flaky connection
-      // doesn't force users to re-login. The WebSocket open itself will
-      // catch a truly bad token via the 4001 path.
-      return true
-    }
-  }
-
-  /**
-   * Surface an auth-expired condition to any paired web clients.
-   *
-   * Two cooperating paths deliver this signal — either alone is enough,
-   * both together cover every timing edge:
-   *
-   *   1. **CLI-initiated (this method):** we detected a 401 from the
-   *      `/refresh` or `/verify` endpoint *while the relay socket is
-   *      still open*. `this.send` pushes the message upstream so the
-   *      server relays it to paired webs before we intentionally close.
-   *      A no-op if the socket is already closed.
-   *
-   *   2. **Server-initiated:** when the platform closes a CLI socket
-   *      with 4001 or 4008, `handleAuthClose` in `clientHandlers.ts`
-   *      broadcasts the same `clientAuthExpired` to paired webs. This
-   *      covers the cases where the CLI never had a chance to detect
-   *      the rejection itself (e.g. token revoked while the socket was
-   *      idle, server-side token rotation).
-   *
-   * IMPORTANT: never call `this.callbacks.onRelayedMessage` here —
-   * that callback feeds INCOMING web→CLI requests into the local handler,
-   * which would treat `clientAuthExpired` as an unknown inbound request.
-   */
-  private notifyAuthExpired(): void {
-    this.send({
-      type: 'clientAuthExpired',
-      data: {
-        connectionId: this.connectionId,
-        message: 'The CLI\'s device token is invalid — run `mstro login --force` on the machine.',
-      },
+    this.tokens = new TokenLifecycle({
+      platformUrl: this.platformUrl,
+      send: (msg) => this.send(msg),
+      getConnectionId: () => this.connectionId,
     })
   }
 
-  private startTokenRefreshCheck(): void {
-    this.tokenRefreshInterval = setInterval(() => {
-      this.maybeRefreshToken()
-    }, 24 * 60 * 60 * 1000)
-  }
-
   private startHeartbeat(): void {
     this.missedPongs = 0
     this.heartbeatInterval = setInterval(() => this.heartbeatTick(), 25_000)
@@ -232,15 +142,9 @@ export class PlatformConnection {
     }
   }
 
-  private stopTokenRefreshCheck(): void {
-    if (this.tokenRefreshInterval) {
-      clearInterval(this.tokenRefreshInterval)
-      this.tokenRefreshInterval = null
-    }
-  }
-
   connect(): void {
     this.isIntentionallyClosed = false
+    this.protocolUpgradeRequired = false
 
     const authToken = getCredentials()?.token
     if (!authToken) {
@@ -262,24 +166,7 @@ export class PlatformConnection {
 
     const connectionTimeout = this.startConnectionTimeout()
     this.attachSocketHandlers(this.ws, authToken, connectionTimeout)
-    this.maybeVerifyTokenInParallel()
-  }
-
-  /**
-   * Best-effort token verification, fired in parallel with the socket
-   * open so a slow verify endpoint never delays reconnect.
-   *
-   * Only runs when the token is stale enough that we'd be about to
-   * refresh anyway — keeps the hot path free of an extra network call.
-   * A truly-revoked token that slips past this check still hits 4001
-   * on the WebSocket, which also triggers `notifyAuthExpired`.
-   */
-  private maybeVerifyTokenInParallel(): void {
-    const creds = getCredentials()
-    if (!creds || !shouldRefreshToken(creds)) return
-    this.verifyToken().then((valid) => {
-      if (!valid) this.notifyAuthExpired()
-    }).catch(() => { /* network error — rely on 4001 close path */ })
+    this.tokens.maybeVerifyInParallel()
   }
 
   private buildConnectionUrl(): string {
@@ -295,6 +182,7 @@ export class PlatformConnection {
       cliVersion: CLI_VERSION,
       capabilities: JSON.stringify({}),
       startedAt: this.startedAt,
+      protocolVersion: String(PROTOCOL_VERSION),
     })
     return `${this.platformUrl.replace(/^http/, 'ws')}/ws/client?${params}`
   }
@@ -319,8 +207,8 @@ export class PlatformConnection {
     ws.onopen = () => {
       clearTimeout(connectionTimeout)
       ws.send(JSON.stringify({ type: 'auth', token: authToken }))
-      this.maybeRefreshToken()
-      this.startTokenRefreshCheck()
+      this.tokens.maybeRefresh()
+      this.tokens.startPeriodicCheck()
       this.reconnectAttempts = 0
       trackEvent(AnalyticsEvents.PLATFORM_CONNECTED)
     }
@@ -342,6 +230,24 @@ export class PlatformConnection {
       clearTimeout(connectionTimeout)
       // onclose will be called after this
     }
+
+    // The Node `ws` library exposes the raw HTTP upgrade response as an
+    // `unexpected-response` event when the server returns a non-101 status
+    // (for us: 426 Upgrade Required from the protocol-version gate). The
+    // global WebSocket in Bun / Node 21+ doesn't expose this — for those
+    // runtimes we rely on the close-code path below. Both paths feed into
+    // `protocolUpgradeRequired`, so `handleSocketClose` can decide once.
+    const wsWithEmitter = ws as unknown as {
+      on?: (event: string, listener: (...args: unknown[]) => void) => void
+    }
+    if (typeof wsWithEmitter.on === 'function') {
+      wsWithEmitter.on('unexpected-response', (...args: unknown[]) => {
+        const response = args[1] as { statusCode?: number } | undefined
+        if (response?.statusCode === 426) {
+          this.protocolUpgradeRequired = true
+        }
+      })
+    }
   }
 
   private handleSocketClose(event: CloseEvent): void {
@@ -350,6 +256,11 @@ export class PlatformConnection {
 
     if (this.isIntentionallyClosed) return
 
+    if (this.isProtocolTooOldClose(event)) {
+      this.handleProtocolUpgradeRequired()
+      return
+    }
+
     const isAuthFailure = event.code === 4001 ||
       event.reason?.includes('Unauthorized') ||
       (event.code === 1006 && !this.everConnected)
@@ -357,7 +268,7 @@ export class PlatformConnection {
     if (isAuthFailure) {
       console.error('\n❌ Authentication failed. Your device token may be invalid or expired.')
       console.error('   Run `mstro login --force` to re-authenticate.\n')
-      this.notifyAuthExpired()
+      this.tokens.notifyAuthExpired()
       this.callbacks.onError?.('Authentication failed - run `mstro login --force`')
       return
     }
@@ -368,6 +279,53 @@ export class PlatformConnection {
     this.scheduleReconnect()
   }
 
+  /**
+   * The relay can refuse a CLI for being too old in two shapes:
+   *
+   *   1. **HTTP 426 during upgrade** — the `ws` library surfaces this via
+   *      its `unexpected-response` event, which sets
+   *      `protocolUpgradeRequired` before `onclose` fires. This is the path
+   *      the current server takes (`checkProtocolVersionGate`).
+   *
+   *   2. **WS close 1002/1008 with `protocol-too-old` reason** — reserved
+   *      for a future server variant that completes the upgrade and then
+   *      closes (e.g. when the policy check moves into a post-handshake
+   *      stage). The reason string is part of the contract with the server.
+   *
+   * Anything else (1006 race after a successful run, 1001 going-away on
+   * deploy) must fall through to the regular reconnect path so transient
+   * failures keep healing on their own.
+   */
+  private isProtocolTooOldClose(event: CloseEvent): boolean {
+    if (this.protocolUpgradeRequired) return true
+    const code = event.code
+    if ((code === 1002 || code === 1008) && event.reason?.includes('protocol-too-old')) {
+      return true
+    }
+    return false
+  }
+
+  private handleProtocolUpgradeRequired(): void {
+    const message = 'Mstro CLI is out of date for this orchestra. Run `mstro` again to upgrade and reconnect.'
+    console.error(`\n❌ ${message}\n`)
+    this.callbacks.onError?.(message)
+    this.callbacks.onDisconnected?.()
+
+    // Don't exit the process — terminal sessions and other local state stay
+    // alive while the user re-runs `mstro`. Schedule a single, far-future
+    // reconnect as a sentinel so we silently retry exactly once if the
+    // process is somehow still around an hour later. The existing
+    // exponential-backoff path is bypassed deliberately: hammering a server
+    // that has already decided to refuse on policy is pointless.
+    if (this.reconnectTimeout) {
+      clearTimeout(this.reconnectTimeout)
+    }
+    this.reconnectTimeout = setTimeout(() => {
+      this.reconnectTimeout = null
+      this.connect()
+    }, PROTOCOL_UPGRADE_RECONNECT_DELAY_MS)
+  }
+
   private handleMessage(message: Record<string, unknown>): void {
     switch (message.type) {
       case 'paired':
@@ -430,7 +388,7 @@ export class PlatformConnection {
   disconnect(): void {
     this.isIntentionallyClosed = true
     this.stopHeartbeat()
-    this.stopTokenRefreshCheck()
+    this.tokens.stopPeriodicCheck()
 
     if (this.reconnectTimeout) {
       clearTimeout(this.reconnectTimeout)

package/server/services/sentry.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 import { existsSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'

package/server/services/settings.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Settings Service

package/server/services/terminal/pty-manager.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * PTY Manager - Manages pseudo-terminal sessions for shell access.

package/server/services/terminal/pty-utils.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * PTY Utilities — node-pty loading, shell detection, scrollback buffer, and types.

package/server/services/websocket/autocomplete.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Autocomplete Service

package/server/services/websocket/file-definition-handlers.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 import { spawn } from 'node:child_process';
 import { join, relative } from 'node:path';

package/server/services/websocket/file-download-handler.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Chunked File Download Handler

package/server/services/websocket/file-explorer-handlers.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 import {
   createDirectory,

package/server/services/websocket/file-search-handlers.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 import { spawn } from 'node:child_process';
 import { relative } from 'node:path';

package/server/services/websocket/file-upload-handler.ts

@@ -1,12 +1,13 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * Chunked File Upload Handler
  *
  * Receives files in chunks over WebSocket from remote web clients.
+ * The destination working directory is passed per-call (effective dir for the tab,
+ * which resolves to the worktree path when the tab is on a worktree).
  * - When `targetPath` is provided: streams to <workingDir>/<targetPath> (drag-drop into file tree).
- * - Otherwise: streams to .mstro/tmp/attachments/{tabId}/ (prompt attachments).
+ * - Otherwise: streams to <workingDir>/.mstro/tmp/attachments/{tabId}/ (prompt attachments).
  */
 
 import type { WriteStream } from 'node:fs';
@@ -50,7 +51,6 @@ export class FileUploadHandler {
   private cleanupInterval: ReturnType<typeof setInterval>;
 
   constructor(
-    private workingDir: string,
     private ctx?: HandlerContext,
   ) {
     // Periodically clean up stale uploads
@@ -74,6 +74,7 @@ export class FileUploadHandler {
     send: (ws: WSContext, response: WebSocketResponse) => void,
     tabId: string,
     data: { uploadId: string; fileName: string; fileSize: number; mimeType: string; isImage: boolean; totalChunks: number; targetPath?: string; overwrite?: boolean },
+    workingDir: string,
     permission?: 'view',
   ): void {
     const { uploadId, fileName, fileSize, mimeType, isImage, totalChunks, targetPath, overwrite } = data;
@@ -89,8 +90,8 @@ export class FileUploadHandler {
     }
 
     const resolved = targetPath !== undefined
-      ? resolveFileTreeTarget({ targetPath, fileName, workingDir: this.workingDir, permission, overwrite })
-      : resolveAttachmentTarget({ workingDir: this.workingDir, tabId, fileName });
+      ? resolveFileTreeTarget({ targetPath, fileName, workingDir, permission, overwrite })
+      : resolveAttachmentTarget({ workingDir, tabId, fileName });
 
     if (!resolved.ok) {
       sendError(resolved.error);

package/server/services/websocket/file-utils.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 /**
  * File Utilities

package/server/services/websocket/git-branch-handlers.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 import { executeGitCommand, sendGitError } from './git-utils.js';
 import { findWorktreePathForBranch, handleTabWorktreeSwitch } from './git-worktree-handlers.js';

package/server/services/websocket/git-diff-handlers.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
-// Licensed under the MIT License. See LICENSE file for details.
 
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';