mulmoclaude 2.9.0 → 2.10.0

package/server/workspace/photo-locations/list.ts

@@ -8,13 +8,13 @@
 // "list all my photo locations" or "render every captured pin on
 // a map view".
 
-import { readdir, readFile } from "node:fs/promises";
 import path from "node:path";
-import { WORKSPACE_DIRS, WORKSPACE_PATHS } from "../paths.js";
+import { WORKSPACE_DIRS } from "../paths.js";
 import { log } from "../../system/logger/index.js";
 import { isRecord } from "../../utils/types.js";
 import type { PhotoExif } from "../../utils/exif.js";
 import type { PhotoLocationSidecar } from "./index.js";
+import { locationsStore } from "./store.js";
 
 /** A sidecar paired with the id used in the filename. The id is the
  *  attachment's stable identifier; consumers (UI, LLM) use it to
@@ -33,15 +33,12 @@ const SIDECAR_EXT = ".json";
  *  the path so an operator can investigate without the listing
  *  crashing. */
 export async function listAllSidecars(): Promise<ListedSidecar[]> {
-  const root = WORKSPACE_PATHS.locations;
-  const yearDirs = await readSubdirsSafe(root);
+  const yearDirs = await readSubdirs("");
   const all: ListedSidecar[] = [];
   for (const year of yearDirs) {
-    const yearAbs = path.join(root, year);
-    const monthDirs = await readSubdirsSafe(yearAbs);
+    const monthDirs = await readSubdirs(year);
     for (const month of monthDirs) {
-      const monthAbs = path.join(yearAbs, month);
-      const sidecars = await readSidecarsInDir(monthAbs, year, month);
+      const sidecars = await readSidecarsInDir(year, month);
       all.push(...sidecars);
     }
   }
@@ -146,39 +143,30 @@ function validateSidecarShape(value: unknown): PhotoLocationSidecar | null {
   return { version: 1, capturedAt, photo: { relativePath, mimeType }, exif: readSidecarExif(exif) };
 }
 
-async function readSubdirsSafe(dir: string): Promise<string[]> {
-  try {
-    const entries = await readdir(dir, { withFileTypes: true });
-    return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-  } catch {
-    // ENOENT on a fresh workspace — locations dir doesn't exist
-    // yet, treat as empty.
-    return [];
-  }
+// A fresh workspace has no locations folder yet; the store lists that as empty.
+async function readSubdirs(storeDir: string): Promise<string[]> {
+  const entries = await locationsStore.listDir(storeDir);
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name);
 }
 
-async function readSidecarsInDir(absDir: string, year: string, month: string): Promise<ListedSidecar[]> {
-  const entries = await readdir(absDir).catch(() => []);
+async function readSidecarsInDir(year: string, month: string): Promise<ListedSidecar[]> {
+  const entries = await locationsStore.listDir(path.posix.join(year, month));
   const out: ListedSidecar[] = [];
-  for (const entry of entries) {
+  for (const { name: entry } of entries) {
     if (!entry.endsWith(SIDECAR_EXT)) continue;
     const sidecarId = entry.slice(0, -SIDECAR_EXT.length);
-    const absPath = path.join(absDir, entry);
+    const relativePath = path.posix.join(WORKSPACE_DIRS.locations, year, month, entry);
     try {
-      const raw = await readFile(absPath, "utf8");
+      const raw = (await locationsStore.read(relativePath)).toString("utf8");
       const parsed: unknown = JSON.parse(raw);
       const sidecar = validateSidecarShape(parsed);
       if (!sidecar) {
-        log.warn("photo-locations", "skipping sidecar with invalid shape", { path: absPath });
+        log.warn("photo-locations", "skipping sidecar with invalid shape", { path: relativePath });
         continue;
       }
-      out.push({
-        id: sidecarId,
-        relativePath: path.posix.join(WORKSPACE_DIRS.locations, year, month, entry),
-        sidecar,
-      });
+      out.push({ id: sidecarId, relativePath, sidecar });
     } catch (err) {
-      log.warn("photo-locations", "skipping malformed sidecar", { path: absPath, error: String(err) });
+      log.warn("photo-locations", "skipping malformed sidecar", { path: relativePath, error: String(err) });
     }
   }
   return out;

package/server/workspace/photo-locations/store.ts

@@ -0,0 +1,4 @@
+import { makeStoreFiles } from "../../utils/files/store-files.js";
+import { WORKSPACE_DIRS, WORKSPACE_PATHS } from "../paths.js";
+
+export const locationsStore = makeStoreFiles(() => WORKSPACE_PATHS.locations, WORKSPACE_DIRS.locations);

package/server/workspace/wiki-pages/io.ts

@@ -19,9 +19,10 @@
 // site wired up means PR 2 is purely an internal change.
 
 import path from "node:path";
-import { mkdir, writeFile } from "node:fs/promises";
+import { realpath } from "node:fs/promises";
 import { readTextSafe } from "../../utils/files/safe.js";
 import { writeFileAtomic } from "../../utils/files/atomic.js";
+import { writeNewFileExclusive } from "../../utils/files/upload-io.js";
 import { mergeFrontmatter, parseFrontmatter, serializeWithFrontmatter } from "@mulmoclaude/markdown-utils/markdown/frontmatter";
 import { isSafeSlug } from "@mulmoclaude/core/wiki";
 import { wikiSlugFromAbsPath } from "@mulmoclaude/core/wiki/paths";
@@ -56,7 +57,7 @@ export interface WikiPageWriteOptions {
    *  injection. Tests pass a fixed `Date` so the round-trip is
    *  deterministic; production uses the wall clock. */
   now?: (() => Date) | undefined;
-  /** Create-only mode: write via `O_EXCL` (`flag: "wx"`) so the
+  /** Create-only mode: write via `O_EXCL` so the
    *  call atomically refuses to overwrite an existing page. The
    *  thrown error has `code: "EEXIST"` — used by the
    *  `POST /api/files/create` route (#1598) to map to a 409 and
@@ -107,7 +108,7 @@ export async function writeWikiPage(slug: string, content: string, meta: WikiWri
   const finalContent = stampFrontmatter(oldContent, content, meta, opts);
   if (opts.exclusive) {
     // Re-anchor the absolute path against the workspace root before
-    // handing it to `mkdir`/`writeFile`. `wikiPagePath` already
+    // handing it to the create. `wikiPagePath` already
     // enforces containment via `isSafeSlug` + `path.join`, but
     // CodeQL's `js/path-injection` analysis doesn't trace through
     // those — the explicit `relative` + `startsWith` containment
@@ -120,11 +121,11 @@ export async function writeWikiPage(slug: string, content: string, meta: WikiWri
       throw new Error(`wiki-pages: refusing to write outside workspace root: ${JSON.stringify(absPath)}`);
     }
     const safeAbsPath = path.join(root, relFromRoot);
-    await mkdir(path.dirname(safeAbsPath), { recursive: true });
-    // `flag: "wx"` is the POSIX `O_EXCL`: atomic create-or-fail.
-    // On a concurrent create race only one call wins; the other
-    // throws `EEXIST`, which the route handler maps to HTTP 409.
-    await writeFile(safeAbsPath, finalContent, { flag: "wx" });
+    // `O_EXCL`: atomic create-or-fail. On a concurrent create race
+    // only one call wins; the other throws `EEXIST`, which the route
+    // handler maps to HTTP 409. The new file is also proven to sit
+    // inside the workspace before any byte is written (#3573).
+    await writeNewFileExclusive(await realpath(root), safeAbsPath, finalContent);
   } else {
     await writeFileAtomic(absPath, finalContent, { uniqueTmp: true });
   }

package/server/utils/files/store-resolvers.ts

@@ -1,58 +0,0 @@
-// Shared resolver factory for file-store modules (attachment-store,
-// image-store). Each store used to define its own
-// `safeResolve(relativePath)` wrapper of identical shape: ensure the
-// root dir exists, cache its realpath, strip the leading store
-// prefix, hand off to `resolveWithinRoot`. That left three name-cloned
-// `safeResolve` functions that all looked read-only but two of them
-// were also being used for writes — see #1754 / #1744.
-//
-// `makeStoreResolvers` collapses the three copies into one and
-// exposes the read/write split through method names. A caller that
-// wants to write reaches for `.forWrite`, which routes through the
-// write-time confinement primitive instead of the read-time one.
-
-import { mkdir, realpath } from "fs/promises";
-import { resolveWithinRoot, resolveWriteWithinRoot } from "./safe.js";
-
-export interface StoreResolvers {
-  forRead: (relativePath: string) => Promise<string>;
-  forWrite: (relativePath: string) => Promise<string>;
-}
-
-// Cache realpath per absolute root, not per factory instance — test
-// setups override `WORKSPACE_PATHS.<dir>` mid-run, so capturing the
-// path at factory-call time would pin every store to the original
-// workspace. Re-reading via `getRoot()` and keying the cache on the
-// returned absolute path means each tmp workspace gets its own entry.
-const realPathCacheByRoot = new Map<string, string>();
-
-async function ensureRoot(getRoot: () => string): Promise<string> {
-  const root = getRoot();
-  const cached = realPathCacheByRoot.get(root);
-  if (cached) return cached;
-  await mkdir(root, { recursive: true });
-  const real = await realpath(root);
-  realPathCacheByRoot.set(root, real);
-  return real;
-}
-
-function stripDirPrefix(relativePath: string, dirPrefix: string): string {
-  return relativePath.replace(new RegExp(`^${dirPrefix}/`), "");
-}
-
-export function makeStoreResolvers(getRoot: () => string, dirPrefix: string): StoreResolvers {
-  return {
-    forRead: async (relativePath) => {
-      const root = await ensureRoot(getRoot);
-      const result = resolveWithinRoot(root, stripDirPrefix(relativePath, dirPrefix));
-      if (!result) throw new Error(`path traversal rejected: ${relativePath}`);
-      return result;
-    },
-    forWrite: async (relativePath) => {
-      const root = await ensureRoot(getRoot);
-      const result = await resolveWriteWithinRoot(root, stripDirPrefix(relativePath, dirPrefix));
-      if (!result) throw new Error(`path traversal rejected: ${relativePath}`);
-      return result;
-    },
-  };
-}