parasor 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 akibe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,208 @@
+# parasor
+
+> AI-first coding workspace for continuing your desktop development flow from
+> anywhere.
+
+parasor runs on your development machine and brings the same AI-driven coding
+workflow to your desk, phone, or another trusted device. Use a browser to work
+with your agents, terminals, Git state, files, and localhost dev servers
+without changing the project environment on the host machine.
+
+## Highlights
+
+- **Multi-agent parallel panes** - split the workspace into terminal, file
+  tree, editor, diff, and browser views while several agents run at once.
+- **Desk-to-mobile workflow** - startup QR seeds the session cookie, mobile
+  controls cover common terminal keys, and clipboard/file upload works in the
+  on-page terminal.
+- **Persistent PTYs** - the user-scope service installs a PTY host daemon so
+  scrollback and sessions survive server restarts.
+- **Project-scoped file ops** - browse files, edit in CodeMirror, open diffs,
+  drag files into terminals, and paste images into an upload directory.
+- **Agent-aware shims** - Claude Code and Codex wrappers add runtime integration
+  hooks without editing user agent configuration files.
+- **Network port center** - detected localhost dev servers can be opened from
+  mobile through parasor-managed reachable URLs when needed.
+- **Token auth + Origin allowlist** - high-entropy URL token and browser
+  Origin checks are enabled by default.
+- **macOS / Linux primary** - user-scope install and service management, no
+  sudo required. WSL is expected to work for foreground use, with service mode
+  depending on systemd-enabled WSL. Native Windows is not currently supported.
+
+## Quick Start
+
+Node.js 22+:
+
+```bash
+pnpm dlx parasor
+# or: npm exec -y parasor
+```
+
+parasor listens on every IPv4 interface (`0.0.0.0`) at port `7681` by default,
+matching common local-dev tools such as ttyd, gotty, Vite `--host`, and Next.js
+dev. The startup banner prints reachable access URLs for loopback, LAN, and
+Tailscale endpoints, followed by a QR code for phone access.
+
+Token auth and WebSocket Origin checks are the primary defense. Use
+`--host 127.0.0.1` or `HOST=127.0.0.1` for loopback-only access.
+
+```bash
+parasor --help             # user-facing subcommands
+parasor --help-all         # also list advanced/internal bridges
+parasor qr                 # re-render QR + access URLs over the IPC socket
+parasor qr --iface=en0     # prefer a specific network interface
+```
+
+The auth token is persisted at `~/.config/parasor/token` (user-scope, plain
+text) if you need to assemble the URL by hand.
+
+## Background Service
+
+Keep parasor up after login. On macOS, the LaunchAgent also starts at user
+login after reboot. On Linux, the systemd user unit starts with the user
+session; start-before-login behavior depends on whether lingering is enabled
+for that account.
+
+```bash
+parasor service install     # LaunchAgent on macOS, systemd user unit on Linux
+parasor service status      # installed / running / pid / uptime
+parasor service restart     # restart the service
+parasor service logs -f     # tail the service log
+parasor service uninstall   # stop + unregister
+```
+
+The service is user-scope only and does not require sudo. The supervisor
+restarts the server if it crashes, and the PTY host daemon keeps PTY sessions
+available across server restarts. The server also exposes a loopback-only
+`GET /healthz` probe for watchdogs.
+
+## Agent PATH Shims
+
+On startup, parasor installs user-scope shims under `~/.config/parasor` (or
+`$PARASOR_CONFIG_DIR` when set) and prepends them only to PTYs spawned by
+parasor. There is no `postinstall` hook, no sudo path, and no write to global
+shell startup files.
+
+Files written by the shim installer:
+
+| Path | Purpose |
+|---|---|
+| `~/.config/parasor/bin/claude` | Wrapper for Claude Code |
+| `~/.config/parasor/bin/codex` | Wrapper for Codex |
+| `~/.config/parasor/bin/open` | macOS `open` shim, only when a real `open` is found |
+| `~/.config/parasor/bin/xdg-open` | Linux `xdg-open` shim, only when a real `xdg-open` is found |
+| `~/.config/parasor/shell/zsh/.zshenv` and `.zshrc` | zsh overlay that sources normal zsh files, then reasserts the parasor shim path |
+| `~/.config/parasor/shell/bash/.bashrc` | bash overlay that sources normal `.bashrc`, then reasserts the parasor shim path |
+
+The Claude wrapper runs the real `claude` binary after injecting runtime hooks
+for the current invocation. The hooks call back to the local parasor server so
+the UI can show agent running, waiting, and completed states. When file drops
+are available, the wrapper also adds the session upload directory through
+Claude's CLI flags. It does not edit `~/.claude/settings.json`.
+
+The Codex wrapper runs the real `codex` binary with a per-process notification
+setting, records the Codex TUI session log, and mirrors task and approval
+events back to parasor. It does not edit `~/.codex` config or change
+`CODEX_HOME`.
+
+The `open` and `xdg-open` shims route explicit terminal URL opens through
+parasor's browser deep-link path when the command is run inside a parasor PTY.
+Outside a live parasor session, the wrappers resolve and exec the real
+binaries.
+
+## Remote Access
+
+parasor itself does not ship a tunnel. The expected mobile flow is: parasor
+runs on your dev machine, and the phone reaches it over a trusted network.
+
+- **Same LAN.** Default bind already covers it. Scan the QR from a phone on the
+  same Wi-Fi.
+- **Tailscale.** With Tailscale running on both ends, the Tailnet IP and
+  MagicDNS hostname are reachable on the default bind.
+- **Cloudflare Tunnel + Access, or equivalent identity-aware proxy.** Use this
+  when you need a stable public URL with SSO or device posture enforced before
+  any request reaches parasor.
+- **SSH port-forward.** Run `parasor --host 127.0.0.1` on the remote side and
+  connect with `ssh -L 7681:127.0.0.1:7681 user@host`.
+
+Direct exposure on a public IP, such as binding `0.0.0.0` on a VPS without an
+overlay or identity-aware proxy in front, is out of scope. See
+[SECURITY.md](./SECURITY.md) for the threat model.
+
+`PARASOR_AUTH=none` refuses to start on a non-loopback bind.
+`PARASOR_ALLOWED_ORIGINS` adds extra browser origins for custom hostnames and
+reverse proxies.
+
+## Opening Localhost Dev Servers From Mobile
+
+When a terminal prints a loopback URL such as `http://localhost:5173`, opening
+that URL on a phone would normally target the phone's own localhost. parasor
+rewrites terminal and port-center open actions for detected loopback ports to a
+reachable address on the parasor host, using a per-port TCP forwarder when the
+dev server is bound to loopback only.
+
+This is different from opening the app's port directly over Tailscale or LAN:
+`http://<dev-machine-tailnet-name>:5173` only works if that app is listening on
+a non-loopback interface. For Vite, that usually means `vite --host 0.0.0.0`
+or `server.host = "0.0.0.0"`.
+
+Security note: most dev servers do not have parasor's token auth. Use direct
+`--host 0.0.0.0` dev-server exposure only on a trusted LAN or Tailnet. If you
+only need to open the app from parasor, leaving the dev server loopback-bound
+and using parasor's generated forwarder URL keeps exposure aligned with
+parasor's own network surface.
+
+## Configuration
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `PORT` | `7681` | HTTP listen port |
+| `HOST` | `0.0.0.0` | Bind address; set `127.0.0.1` for loopback-only |
+| `PARASOR_AUTH` | `token` | `token` or `none`; `none` is allowed only on loopback binds |
+| `PARASOR_CONFIG_DIR` | `~/.config/parasor` | Persistent state directory |
+| `PARASOR_ALLOWED_ORIGINS` | empty | Extra browser origins for WebSocket allowlist |
+
+## Development
+
+```bash
+pnpm install
+pnpm dev          # backend on :7682, Vite on :7683
+pnpm test         # all workspaces
+pnpm typecheck    # TypeScript checks across packages
+pnpm lint         # Biome + layer boundary checks
+pnpm lint:fix     # apply Biome fixes
+pnpm build        # TypeScript + Vite build
+pnpm package      # assemble publishable dist/
+pnpm clean        # remove build outputs
+pnpm clean:dev    # stop dev leftovers and clear dev lockfiles
+```
+
+For local CLI install after source changes:
+
+```bash
+pnpm install:local
+pnpm uninstall:local
+```
+
+Dev mode isolates itself from a running production parasor: backend port
+defaults to `7682`, the Vite dev server defaults to `7683`, and
+`PARASOR_CONFIG_DIR` defaults to `/tmp/parasor-dev`.
+
+Requires Node.js 22+ and pnpm. macOS and Linux are primary. WSL is expected to
+work for foreground use, but service mode requires systemd-enabled WSL. Native
+Windows is not currently supported.
+
+## Status
+
+Pre-1.0. Configuration shape and CLI surface may change before `1.0.0`.
+
+## License
+
+MIT - see [LICENSE](./LICENSE).
+
+## Acknowledgements
+
+Built with [Hono](https://hono.dev), [node-pty](https://github.com/microsoft/node-pty),
+[xterm.js](https://xtermjs.org), [React](https://react.dev),
+[Vite](https://vitejs.dev), [Tailwind CSS](https://tailwindcss.com), and
+[CodeMirror](https://codemirror.net).

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,138 @@
+# Third-Party Notices
+
+This product bundles the following third-party assets or copied code snippets.
+Each is used under the terms of its respective license as described below.
+
+---
+
+## Symbols Nerd Font
+
+- **File**: `packages/web/src/assets/fonts/SymbolsNerdFontMono-Regular.woff2`
+- **Version**: Nerd Fonts v3.2.1 (`patched-fonts/NerdFontsSymbolsOnly`)
+- **Source**: <https://github.com/ryanoasis/nerd-fonts>
+- **License**: MIT License -- Copyright (c) 2014 Ryan L McIntyre
+- **License file**: `packages/web/src/assets/fonts/LICENSE-SymbolsNerdFont.txt`
+
+Symbols Nerd Font is a compilation of glyph sets from multiple upstream icon
+font projects. The glyphs included are aggregated and redistributed by the
+Nerd Fonts project under the MIT license. Notable upstream sources include:
+
+| Source | Original license |
+| --- | --- |
+| [Powerline Symbols](https://github.com/powerline/powerline) | MIT |
+| [Font Awesome](https://github.com/FortAwesome/Font-Awesome) | OFL-1.1 / MIT |
+| [Devicons](https://github.com/vorillaz/devicons) | MIT |
+| [Octicons](https://github.com/primer/octicons) | MIT |
+| [Codicons](https://github.com/microsoft/vscode-codicons) | CC-BY-4.0 |
+| [Font Logos](https://github.com/Lukas-W/font-logos) | MIT |
+| [Material Design Icons](https://github.com/Templarian/MaterialDesign) | Apache-2.0 |
+| [Weather Icons](https://github.com/erikflowers/weather-icons) | OFL-1.1 |
+| [Pomicons](https://github.com/gabrielelana/pomicons) | MIT |
+| [Seti-UI + Custom](https://github.com/jesseweed/seti-ui) | MIT |
+| [IEC Power Symbols](https://unicodepowersymbol.com/) | OFL-1.1 |
+
+All upstream licenses permit redistribution as part of a bundled application
+when the applicable copyright notices and license terms are preserved. The
+MIT license text that governs the `NerdFontsSymbolsOnly` package is included
+in full alongside the font file.
+
+---
+
+## Vendored color themes
+
+- **Files**:
+  - `packages/web/src/vendor/themes/tokyo-night.json`
+  - `packages/web/src/vendor/themes/solarized-light.json`
+  - `packages/web/src/vendor/themes/monokai.json`
+- **Sources**:
+  - Tokyo Night: <https://github.com/tokyo-night/tokyo-night-vscode-theme>
+  - Microsoft VS Code built-in themes: <https://github.com/microsoft/vscode>
+- **License**: MIT
+- **License file**: `packages/web/src/vendor/themes/LICENSE`
+
+The vendored theme JSON files are distributed under the MIT License. The
+aggregated upstream notices are kept in
+`packages/web/src/vendor/themes/LICENSE`.
+
+---
+
+## Symbols (FileTree icons)
+
+- **Package**: `@react-symbols/icons`
+- **Source**: <https://github.com/pheralb/react-symbols>
+- **License**: MIT -- Copyright (c) pheralb
+- **Origin**: React port of the [Symbols VSCode icon theme](https://marketplace.visualstudio.com/items?itemName=miguelsolorio.symbols) by Miguel Solorio (MIT). Used for file-type and folder icons in the FileTree pane.
+
+The package ships individually-importable React SVG components, so parasor
+only bundles the subset of icons it actually references in
+`packages/web/src/lib/file-icons.tsx`.
+
+---
+
+## Lucide icons
+
+- **Source**: <https://github.com/lucide-icons/lucide>
+- **License**: ISC -- Copyright (c) 2026 Lucide Icons and Contributors
+- **Origin files**:
+  - `packages/web/src/components/primitives/PaGlyph.tsx`
+  - `packages/web/src/components/mobile/MobileKeyBar.tsx`
+
+The icon paths in the listed files are adapted from individual Lucide SVG
+files. Lucide is a community-maintained fork of Feather Icons; some glyphs
+trace back to Feather (MIT, Copyright (c) 2013-present Cole Bemis). Both
+upstream licenses permit redistribution with the copyright notices preserved.
+
+```
+ISC License
+
+Copyright (c) 2026 Lucide Icons and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+```
+
+Glyphs in `PaGlyph.tsx` derived from icons originally introduced by Feather
+also fall under the Feather MIT terms:
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2013-present Cole Bemis
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the "Software"),
+to deal in the Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+```
+
+---
+
+## Runtime-downloaded font presets
+
+The settings UI can download optional monospace font presets from upstream
+GitHub Releases at user request. Those preset font files are not bundled in
+the parasor source tree or npm package; parasor only stores a whitelist of
+approved release asset URLs and extracts one Regular TTF into the user's local
+font cache after the user starts the download.

package/bin/parasor.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { runCli } from "../server/cli/main.js";
+await runCli(process.argv.slice(2));

package/node_modules/@parasor/shared/dist/client.d.ts

@@ -0,0 +1,8 @@
+export interface ClientPreferences {
+    clientId: string;
+    focusedProjectId: string | null;
+    focusedPaneId: string | null;
+    mobileFocusedPaneId: string | null;
+    sidebarOpen: boolean;
+}
+//# sourceMappingURL=client.d.ts.map

package/node_modules/@parasor/shared/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,OAAO,CAAC;CACtB"}

package/node_modules/@parasor/shared/dist/client.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=client.js.map

package/node_modules/@parasor/shared/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":""}

package/node_modules/@parasor/shared/dist/drops.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Success payload returned by `POST /api/projects/:id/drops?sessionId=...`.
+ * Absolute paths are server-resolved under the per-session staging dir
+ * (`<PARASOR_UPLOAD_DIR>/<sessionId>-<ms>/`), which lives outside the
+ * project tree (upload staging isolation). The 3-layer GC owns lifetime: L1 on PTY
+ * exit, L2 at server boot, L3 every 60 minutes.
+ */
+export interface DropResponse {
+    paths: string[];
+}
+export type DropRejectReason = "path-traversal" | "control-char" | "too-long" | "empty" | "reserved";
+export interface DropErrorTooLarge {
+    error: "too-large";
+    limit: number;
+}
+export interface DropErrorInvalidFilename {
+    error: "invalid-filename";
+    reason: DropRejectReason;
+}
+export interface DropErrorIo {
+    error: "io-error";
+}
+export type DropErrorResponse = DropErrorTooLarge | DropErrorInvalidFilename | DropErrorIo;
+//# sourceMappingURL=drops.d.ts.map

package/node_modules/@parasor/shared/dist/drops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drops.d.ts","sourceRoot":"","sources":["../src/drops.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,OAAO,GACP,UAAU,CAAC;AAEf,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB,iBAAiB,GACjB,wBAAwB,GACxB,WAAW,CAAC"}

package/node_modules/@parasor/shared/dist/drops.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=drops.js.map

package/node_modules/@parasor/shared/dist/drops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drops.js","sourceRoot":"","sources":["../src/drops.ts"],"names":[],"mappings":""}

package/node_modules/@parasor/shared/dist/file-uploads.d.ts

@@ -0,0 +1,56 @@
+/**
+ * File-tree upload protocol (file-tree upload).
+ *
+ * Distinct from `/drops` (terminal pane) which lands files under
+ * `.parasor/drops/<timestamp>_<name>` for shell paste. This endpoint
+ * writes directly into the user's project tree at a target subdirectory.
+ *
+ * Conflict semantics are decided per request via `disposition`. The
+ * client surfaces a "Replace / Keep both / Skip" modal once per batch
+ * and applies the chosen mode to every file in the request.
+ */
+export type FileUploadDisposition = "replace" | "keep-both" | "skip";
+export interface FileUploadResultEntry {
+    /** Filename as supplied by the client. */
+    originalName: string;
+    /** What ended up happening on disk. */
+    status: "written" | "renamed" | "skipped";
+    /** Final basename written (only when `status !== "skipped"`). */
+    finalName?: string;
+    /** Server-resolved absolute path (only when `status !== "skipped"`). */
+    finalPath?: string;
+}
+export interface FileUploadResponse {
+    files: FileUploadResultEntry[];
+}
+export type FileUploadRejectReason = "path-traversal" | "control-char" | "too-long" | "empty" | "reserved";
+export interface FileUploadErrorTooLarge {
+    error: "too-large";
+    limit: number;
+}
+export interface FileUploadErrorInvalidFilename {
+    error: "invalid-filename";
+    reason: FileUploadRejectReason;
+}
+export interface FileUploadErrorInvalidTarget {
+    error: "invalid-target";
+    /**
+     * `path-traversal` -- `targetDir` resolves outside the project root.
+     * `not-a-dir`     -- `targetDir` exists but is a file (or symlink to one).
+     * `missing`       -- `targetDir` does not exist on disk.
+     */
+    reason: "path-traversal" | "not-a-dir" | "missing";
+}
+export interface FileUploadErrorReadOnly {
+    error: "read-only";
+}
+export interface FileUploadErrorIo {
+    error: "io-error";
+}
+export interface FileUploadErrorConflict {
+    error: "conflict";
+    /** Existing filenames that prevented the write under `disposition: "skip"`. */
+    conflicts: string[];
+}
+export type FileUploadErrorResponse = FileUploadErrorTooLarge | FileUploadErrorInvalidFilename | FileUploadErrorInvalidTarget | FileUploadErrorReadOnly | FileUploadErrorIo | FileUploadErrorConflict;
+//# sourceMappingURL=file-uploads.d.ts.map

package/node_modules/@parasor/shared/dist/file-uploads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-uploads.d.ts","sourceRoot":"","sources":["../src/file-uploads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC1C,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,OAAO,GACP,UAAU,CAAC;AAEf,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,sBAAsB,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;;OAIG;IACH,MAAM,EAAE,gBAAgB,GAAG,WAAW,GAAG,SAAS,CAAC;CACpD;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,uBAAuB,GAC/B,uBAAuB,GACvB,8BAA8B,GAC9B,4BAA4B,GAC5B,uBAAuB,GACvB,iBAAiB,GACjB,uBAAuB,CAAC"}

package/node_modules/@parasor/shared/dist/file-uploads.js

@@ -0,0 +1,13 @@
+/**
+ * File-tree upload protocol (file-tree upload).
+ *
+ * Distinct from `/drops` (terminal pane) which lands files under
+ * `.parasor/drops/<timestamp>_<name>` for shell paste. This endpoint
+ * writes directly into the user's project tree at a target subdirectory.
+ *
+ * Conflict semantics are decided per request via `disposition`. The
+ * client surfaces a "Replace / Keep both / Skip" modal once per batch
+ * and applies the chosen mode to every file in the request.
+ */
+export {};
+//# sourceMappingURL=file-uploads.js.map

package/node_modules/@parasor/shared/dist/file-uploads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-uploads.js","sourceRoot":"","sources":["../src/file-uploads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/node_modules/@parasor/shared/dist/ide-commands.d.ts

@@ -0,0 +1,8 @@
+export interface IdeCommandConfig {
+    id: string;
+    label: string;
+    command: string;
+    args: string[];
+}
+export declare function normalizeIdeCommands(value: unknown): IdeCommandConfig[];
+//# sourceMappingURL=ide-commands.d.ts.map

package/node_modules/@parasor/shared/dist/ide-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ide-commands.d.ts","sourceRoot":"","sources":["../src/ide-commands.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAUD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,EAAE,CAiDvE"}

package/node_modules/@parasor/shared/dist/ide-commands.js

@@ -0,0 +1,59 @@
+const MAX_COMMANDS = 50;
+const MAX_ID_LENGTH = 128;
+const MAX_LABEL_LENGTH = 200;
+const MAX_COMMAND_LENGTH = 1000;
+const MAX_ARGS = 50;
+const MAX_ARG_LENGTH = 1000;
+const RESERVED_IDS = new Set(["cursor", "vscode"]);
+export function normalizeIdeCommands(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const item of value) {
+        if (!isPlainObject(item))
+            continue;
+        const id = item.id;
+        const label = item.label;
+        const command = item.command;
+        const args = item.args;
+        if (typeof id !== "string" ||
+            typeof label !== "string" ||
+            typeof command !== "string" ||
+            !Array.isArray(args) ||
+            id.length > MAX_ID_LENGTH) {
+            continue;
+        }
+        const normalizedId = id.trim();
+        const normalizedLabel = label.trim();
+        const normalizedCommand = command.trim();
+        const normalizedArgs = args
+            .filter((arg) => typeof arg === "string")
+            .map((arg) => arg.trim())
+            .filter((arg) => arg.length > 0 && arg.length <= MAX_ARG_LENGTH)
+            .slice(0, MAX_ARGS);
+        if (!normalizedId ||
+            RESERVED_IDS.has(normalizedId) ||
+            seen.has(normalizedId) ||
+            !normalizedLabel ||
+            normalizedLabel.length > MAX_LABEL_LENGTH ||
+            !normalizedCommand ||
+            normalizedCommand.length > MAX_COMMAND_LENGTH) {
+            continue;
+        }
+        seen.add(normalizedId);
+        out.push({
+            id: normalizedId,
+            label: normalizedLabel,
+            command: normalizedCommand,
+            args: normalizedArgs,
+        });
+        if (out.length >= MAX_COMMANDS)
+            break;
+    }
+    return out;
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=ide-commands.js.map

package/node_modules/@parasor/shared/dist/ide-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ide-commands.js","sourceRoot":"","sources":["../src/ide-commands.ts"],"names":[],"mappings":"AAOA,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IACE,OAAO,EAAE,KAAK,QAAQ;YACtB,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACpB,EAAE,CAAC,MAAM,GAAG,aAAa,EACzB,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,IAAI;aACxB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;aACvD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,cAAc,CAAC;aAC/D,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtB,IACE,CAAC,YAAY;YACb,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACtB,CAAC,eAAe;YAChB,eAAe,CAAC,MAAM,GAAG,gBAAgB;YACzC,CAAC,iBAAiB;YAClB,iBAAiB,CAAC,MAAM,GAAG,kBAAkB,EAC7C,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,YAAY;YAChB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,iBAAiB;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,YAAY;YAAE,MAAM;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/node_modules/@parasor/shared/dist/pane-commands.d.ts

@@ -0,0 +1,7 @@
+export interface PaneCommandConfig {
+    id: string;
+    label: string;
+    initialInput: string;
+}
+export declare function normalizePaneCommands(value: unknown): PaneCommandConfig[];
+//# sourceMappingURL=pane-commands.d.ts.map

package/node_modules/@parasor/shared/dist/pane-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-commands.d.ts","sourceRoot":"","sources":["../src/pane-commands.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,EAAE,CAwCzE"}

package/node_modules/@parasor/shared/dist/pane-commands.js

@@ -0,0 +1,47 @@
+const MAX_COMMANDS = 100;
+const MAX_ID_LENGTH = 128;
+const MAX_LABEL_LENGTH = 200;
+const MAX_INITIAL_INPUT_LENGTH = 4000;
+export function normalizePaneCommands(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const item of value) {
+        if (!isPlainObject(item))
+            continue;
+        const id = item.id;
+        const label = item.label;
+        const initialInput = item.initialInput;
+        if (typeof id !== "string" ||
+            typeof label !== "string" ||
+            typeof initialInput !== "string" ||
+            id.length > MAX_ID_LENGTH ||
+            initialInput.length > MAX_INITIAL_INPUT_LENGTH) {
+            continue;
+        }
+        const normalizedLabel = label.trim();
+        const normalizedInput = initialInput.trim();
+        if (!id ||
+            id.startsWith("builtin:") ||
+            seen.has(id) ||
+            !normalizedLabel ||
+            normalizedLabel.length > MAX_LABEL_LENGTH ||
+            !normalizedInput) {
+            continue;
+        }
+        seen.add(id);
+        out.push({
+            id,
+            label: normalizedLabel,
+            initialInput: normalizedInput,
+        });
+        if (out.length >= MAX_COMMANDS)
+            break;
+    }
+    return out;
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=pane-commands.js.map

package/node_modules/@parasor/shared/dist/pane-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-commands.js","sourceRoot":"","sources":["../src/pane-commands.ts"],"names":[],"mappings":"AAMA,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IACE,OAAO,EAAE,KAAK,QAAQ;YACtB,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,YAAY,KAAK,QAAQ;YAChC,EAAE,CAAC,MAAM,GAAG,aAAa;YACzB,YAAY,CAAC,MAAM,GAAG,wBAAwB,EAC9C,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;QAC5C,IACE,CAAC,EAAE;YACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACZ,CAAC,eAAe;YAChB,eAAe,CAAC,MAAM,GAAG,gBAAgB;YACzC,CAAC,eAAe,EAChB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,EAAE;YACF,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,eAAe;SAC9B,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,YAAY;YAAE,MAAM;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}