myrlin-workbook 0.9.24 → 0.9.26

package/logs/server.pid

@@ -1 +1 @@
-68900
+44496

package/package.json

@@ -1,66 +1,67 @@
-{
-  "name": "myrlin-workbook",
-  "version": "0.9.24",
-  "description": "Browser-based project manager for Claude Code sessions - session discovery, multi-terminal, cost tracking, docs, and kanban board",
-  "main": "src/index.js",
-  "bin": {
-    "myrlin-workbook": "./src/gui.js",
-    "myrlin": "./src/gui.js",
-    "myrlin-tui": "./src/index.js",
-    "cwm": "./src/index.js"
-  },
-  "scripts": {
-    "start": "node src/index.js",
-    "demo": "node src/demo.js",
-    "gui": "node src/supervisor.js",
-    "gui:daemon": "node src/supervisor.js --daemon",
-    "gui:bare": "node src/gui.js",
-    "gui:demo": "node src/supervisor.js --demo",
-    "test": "node test/run.js",
-    "mcp:visual-qa": "node src/mcp/visual-qa.js",
-    "gui:cdp": "node src/supervisor.js --cdp",
-    "postinstall": "node scripts/postinstall.js",
-    "restart": "bash scripts/restart-gui.sh"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/therealarthur/myrlin-workbook.git"
-  },
-  "homepage": "https://github.com/therealarthur/myrlin-workbook",
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "keywords": [
-    "claude",
-    "workspace",
-    "manager",
-    "terminal",
-    "tui",
-    "ai",
-    "coding-assistant",
-    "session-manager",
-    "developer-tools",
-    "xterm",
-    "myrlin"
-  ],
-  "author": "Arthur",
-  "license": "AGPL-3.0-only",
-  "dependencies": {
-    "blessed": "^0.1.81",
-    "blessed-contrib": "^4.11.0",
-    "chalk": "^5.6.2",
-    "chrome-remote-interface": "^0.34.0",
-    "express": "^5.2.1",
-    "node-pty": "^1.1.0",
-    "qrcode": "^1.5.4",
-    "ws": "^8.19.0"
-  },
-  "devDependencies": {
-    "@playwright/test": "^1.58.2",
-    "@xterm/addon-fit": "^0.11.0",
-    "@xterm/addon-web-links": "^0.12.0",
-    "@xterm/xterm": "^6.0.0",
-    "ffmpeg-static": "^5.3.0",
-    "sharp": "^0.34.5"
-  }
-}
+{
+  "name": "myrlin-workbook",
+  "version": "0.9.26",
+  "description": "Browser-based project manager for Claude Code sessions - session discovery, multi-terminal, cost tracking, docs, and kanban board",
+  "main": "src/index.js",
+  "bin": {
+    "myrlin-workbook": "./src/gui.js",
+    "myrlin": "./src/gui.js",
+    "myrlin-tui": "./src/index.js",
+    "cwm": "./src/index.js"
+  },
+  "scripts": {
+    "start": "node src/index.js",
+    "demo": "node src/demo.js",
+    "gui": "node src/supervisor.js",
+    "gui:daemon": "node src/supervisor.js --daemon",
+    "gui:bare": "node src/gui.js",
+    "gui:demo": "node src/supervisor.js --demo",
+    "test": "node test/run.js",
+    "mcp:visual-qa": "node src/mcp/visual-qa.js",
+    "gui:cdp": "node src/supervisor.js --cdp",
+    "postinstall": "node scripts/postinstall.js",
+    "restart": "bash scripts/restart-gui.sh"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/therealarthur/myrlin-workbook.git"
+  },
+  "homepage": "https://github.com/therealarthur/myrlin-workbook",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "keywords": [
+    "claude",
+    "workspace",
+    "manager",
+    "terminal",
+    "tui",
+    "ai",
+    "coding-assistant",
+    "session-manager",
+    "developer-tools",
+    "xterm",
+    "myrlin"
+  ],
+  "author": "Arthur",
+  "license": "AGPL-3.0-only",
+  "dependencies": {
+    "blessed": "^0.1.81",
+    "blessed-contrib": "^4.11.0",
+    "chalk": "^5.6.2",
+    "chrome-remote-interface": "^0.34.0",
+    "express": "^5.2.1",
+    "node-pty": "^1.1.0",
+    "qrcode": "^1.5.4",
+    "simple-git": "^3.33.0",
+    "ws": "^8.19.0"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.58.2",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/addon-web-links": "^0.12.0",
+    "@xterm/xterm": "^6.0.0",
+    "ffmpeg-static": "^5.3.0",
+    "sharp": "^0.34.5"
+  }
+}

package/src/web/file-manager.js

@@ -0,0 +1,149 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Map of file extensions to CodeMirror language names.
+ */
+const EXT_TO_LANG = {
+  js: 'javascript', mjs: 'javascript', cjs: 'javascript',
+  ts: 'typescript', tsx: 'typescript',
+  jsx: 'javascript',
+  json: 'json',
+  html: 'html', htm: 'html',
+  css: 'css', scss: 'css', less: 'css',
+  md: 'markdown', markdown: 'markdown',
+  py: 'python',
+  sh: 'shell', bash: 'shell',
+  yaml: 'yaml', yml: 'yaml',
+  toml: 'toml',
+  rs: 'rust',
+  go: 'go',
+  java: 'java',
+  rb: 'ruby',
+  php: 'php',
+  sql: 'sql',
+  xml: 'xml',
+  txt: 'text',
+};
+
+/**
+ * Directory names to skip when building the file tree.
+ * Prevents traversal into version control internals and build artifacts.
+ */
+const SKIP_DIRS = new Set([
+  '.git', 'node_modules', '.DS_Store', '__pycache__',
+  '.next', 'dist', 'build', '.cache',
+]);
+
+/**
+ * Validate that the resolved target path stays within root.
+ * Throws if path traversal is detected.
+ *
+ * @param {string} root - Absolute workspace root path
+ * @param {string} relPath - Relative path from client
+ * @returns {string} Resolved absolute path
+ */
+function validatePath(root, relPath) {
+  if (!root || typeof root !== 'string') throw new Error('root is required');
+  const resolved = path.resolve(root, relPath || '');
+  if (!resolved.startsWith(path.resolve(root) + path.sep) && resolved !== path.resolve(root)) {
+    throw new Error('Path traversal detected');
+  }
+  return resolved;
+}
+
+/**
+ * GET /api/files/tree
+ * Returns directory entries (dirs and files) for a given subpath within the
+ * workspace root. Skips .git, node_modules, and other build artifacts.
+ *
+ * @param {string} workingDir - Workspace root directory
+ * @param {string} [subpath=''] - Relative subpath to list
+ * @returns {Promise<{path: string, entries: Array}>}
+ */
+async function getTree(workingDir, subpath = '') {
+  const root = path.resolve(workingDir);
+  const target = validatePath(root, subpath);
+
+  const entries = await fs.promises.readdir(target, { withFileTypes: true });
+  const result = [];
+
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry.name)) continue;
+    // Skip hidden files/dirs (dot-files) at root level
+    if (subpath === '' && entry.name.startsWith('.')) continue;
+    const relPath = subpath ? path.join(subpath, entry.name) : entry.name;
+    if (entry.isDirectory()) {
+      result.push({ name: entry.name, path: relPath, type: 'dir' });
+    } else if (entry.isFile()) {
+      const ext = path.extname(entry.name).slice(1).toLowerCase();
+      result.push({ name: entry.name, path: relPath, type: 'file', ext });
+    }
+  }
+
+  // Sort: directories first, then files, each group sorted alphabetically
+  result.sort((a, b) => {
+    if (a.type !== b.type) return a.type === 'dir' ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+
+  return { path: subpath || '/', entries: result };
+}
+
+/**
+ * GET /api/files/content
+ * Returns file content as UTF-8 text with a language hint for CodeMirror.
+ * Rejects files larger than 5MB.
+ *
+ * @param {string} workingDir - Workspace root directory
+ * @param {string} file - Relative path to the file
+ * @returns {Promise<{content: string, language: string, size: number, path: string}>}
+ */
+async function getContent(workingDir, file) {
+  if (!file) throw new Error('file is required');
+  const root = path.resolve(workingDir);
+  const target = validatePath(root, file);
+
+  const stat = await fs.promises.stat(target);
+  if (stat.size > 5 * 1024 * 1024) throw new Error('File too large (> 5MB)');
+
+  const content = await fs.promises.readFile(target, 'utf8');
+  const ext = path.extname(file).slice(1).toLowerCase();
+  return {
+    content,
+    language: EXT_TO_LANG[ext] || 'text',
+    size: stat.size,
+    path: file,
+  };
+}
+
+/**
+ * POST /api/files/save
+ * Atomically writes file content by writing to a temp file then renaming.
+ * Creates parent directories if they don't exist.
+ *
+ * @param {string} workingDir - Workspace root directory
+ * @param {string} file - Relative path to the file
+ * @param {string} content - UTF-8 text content to write
+ * @returns {Promise<{ok: boolean}>}
+ */
+async function saveContent(workingDir, file, content) {
+  if (!file) throw new Error('file is required');
+  if (typeof content !== 'string') throw new Error('content must be a string');
+  const root = path.resolve(workingDir);
+  const target = validatePath(root, file);
+
+  // Ensure parent directory exists
+  await fs.promises.mkdir(path.dirname(target), { recursive: true });
+
+  // Atomic write: write to temp file then rename into place
+  const tmp = target + '.tmp.' + Date.now();
+  await fs.promises.writeFile(tmp, content, 'utf8');
+  await fs.promises.rename(tmp, target);
+
+  return { ok: true };
+}
+
+module.exports = { getTree, getContent, saveContent };

package/src/web/git-manager.js

@@ -0,0 +1,115 @@
+'use strict';
+
+/**
+ * Git Manager - wraps simple-git for use in API endpoints.
+ *
+ * All functions accept a workingDir string and perform git operations
+ * scoped to that directory. path.resolve() is used to prevent traversal.
+ */
+
+const { simpleGit } = require('simple-git');
+const path = require('path');
+
+/**
+ * Resolve and validate the working directory for git operations.
+ * @param {string} workingDir - The workspace working directory
+ * @returns {string} The resolved absolute path
+ */
+function resolveGitDir(workingDir) {
+  if (!workingDir || typeof workingDir !== 'string') {
+    throw new Error('workingDir is required');
+  }
+  return path.resolve(workingDir);
+}
+
+/**
+ * Get the current git status for a working directory.
+ * Returns branch name, staged/modified/untracked/deleted files.
+ * @param {string} workingDir - Workspace root directory
+ * @returns {Promise<object>} Status object with branch and file lists
+ */
+async function getStatus(workingDir) {
+  const git = simpleGit(resolveGitDir(workingDir));
+  const status = await git.status();
+  return {
+    branch: status.current,
+    staged: status.staged.map(f => ({ file: f, state: 'staged' })),
+    modified: status.modified.map(f => ({ file: f, state: 'modified' })),
+    notAdded: status.not_added.map(f => ({ file: f, state: 'untracked' })),
+    deleted: status.deleted.map(f => ({ file: f, state: 'deleted' })),
+    isClean: status.isClean(),
+  };
+}
+
+/**
+ * Get the commit log for a working directory.
+ * @param {string} workingDir - Workspace root directory
+ * @param {number} [limit=20] - Maximum number of commits to return (capped at 100)
+ * @returns {Promise<Array>} Array of commit objects with hash, author, date, message
+ */
+async function getLog(workingDir, limit = 20) {
+  const git = simpleGit(resolveGitDir(workingDir));
+  try {
+    const log = await git.log({ maxCount: Math.min(parseInt(limit, 10) || 20, 100) });
+    return (log.all || []).map(c => ({
+      hash: c.hash,
+      shortHash: c.hash.slice(0, 7),
+      author: c.author_name,
+      date: c.date,
+      message: c.message,
+    }));
+  } catch (e) {
+    // Fresh repo with no commits yet
+    if (e.message && e.message.includes('does not have any commits')) return [];
+    throw e;
+  }
+}
+
+/**
+ * Get the diff for a specific file in the working directory.
+ * @param {string} workingDir - Workspace root directory
+ * @param {string} file - File path relative to workingDir
+ * @param {boolean} [staged=false] - Whether to show staged diff (vs unstaged)
+ * @returns {Promise<string>} The unified diff output
+ */
+async function getDiff(workingDir, file, staged = false) {
+  const git = simpleGit(resolveGitDir(workingDir));
+  let diff;
+  if (staged) {
+    diff = await git.diff(['--cached', '--', file]);
+  } else {
+    diff = await git.diff(['--', file]);
+  }
+  return diff || '';
+}
+
+/**
+ * Get branch information for a working directory.
+ * @param {string} workingDir - Workspace root directory
+ * @returns {Promise<{current: string, all: string[]}>} Current branch and all branch names
+ */
+async function getBranches(workingDir) {
+  const git = simpleGit(resolveGitDir(workingDir));
+  const result = await git.branch(['-a']);
+  return {
+    current: result.current,
+    all: result.all,
+  };
+}
+
+/**
+ * Get the full diff output for a specific commit (git show).
+ * @param {string} workingDir - Workspace root directory
+ * @param {string} hash - Full or short commit hash
+ * @returns {Promise<string>} The unified diff/show output
+ */
+async function getCommitDiff(workingDir, hash) {
+  if (!hash || !/^[0-9a-f]{4,40}$/i.test(hash)) {
+    throw new Error('Invalid commit hash');
+  }
+  const git = simpleGit(resolveGitDir(workingDir));
+  const output = await git.show([hash, '--stat', '--patch']);
+  return output || '';
+}
+
+module.exports = { getStatus, getLog, getDiff, getBranches, getCommitDiff };