parasor 0.1.0

package/server/auth/token.js

@@ -0,0 +1,115 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { setCookie } from "hono/cookie";
+export const COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+export function setParasorAuthCookie(c, token, url) {
+    setCookie(c, "parasor_token", token, {
+        httpOnly: true,
+        sameSite: "Strict",
+        path: "/",
+        maxAge: COOKIE_MAX_AGE_SECONDS,
+        secure: url.protocol === "https:",
+    });
+}
+export class TokenAuth {
+    token;
+    tokenPath;
+    constructor(opts) {
+        this.tokenPath = join(opts.dir, "token");
+        this.token = opts.ephemeral ? this.generate(false) : this.loadOrGenerate();
+    }
+    verify(candidate) {
+        const a = Buffer.from(candidate, "utf-8");
+        const b = Buffer.from(this.token, "utf-8");
+        if (a.length !== b.length)
+            return false;
+        return timingSafeEqual(a, b);
+    }
+    extractToken(search, cookieHeader) {
+        const query = search.startsWith("?") ? search : `?${search}`;
+        const url = new URL(`http://localhost${query}`);
+        const queryToken = url.searchParams.get("t");
+        if (queryToken)
+            return queryToken;
+        if (cookieHeader) {
+            const match = cookieHeader.match(/parasor_token=([^;]+)/);
+            if (match)
+                return match[1];
+        }
+        return null;
+    }
+    middleware(mode, allowedCidrs, trustProxy = false) {
+        return async (c, next) => {
+            if (mode === "none")
+                return next();
+            if (c.req.path === "/api/health")
+                return next();
+            if (mode === "allowlist") {
+                const remoteAddress = c.env
+                    ?.remoteAddress;
+                // `x-forwarded-for` is set by the client and is trivially spoofable;
+                // honoring it on a direct connection lets anyone forge an allowed IP
+                // and bypass the CIDR allowlist. Only trust it when explicitly behind
+                // a known reverse proxy; otherwise use the real socket address, and
+                // deny when no address is available (never fall back to a wildcard).
+                const clientIp = trustProxy
+                    ? (c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ??
+                        remoteAddress)
+                    : remoteAddress;
+                if (clientIp &&
+                    allowedCidrs?.some((cidr) => isInCidr(clientIp, cidr))) {
+                    return next();
+                }
+                return c.json({ error: "Forbidden" }, 403);
+            }
+            const reqUrl = new URL(c.req.url);
+            const cookieHeader = c.req.header("cookie");
+            const candidate = this.extractToken(reqUrl.search, cookieHeader);
+            if (candidate && this.verify(candidate)) {
+                // Only swap to cookie + redirect when `t` is an actual query
+                // parameter, not when "t=" merely appears as a substring in any
+                // other parameter name (e.g. `limit=`, `worktreePath=`,
+                // `set=`). The previous `search.includes("t=")` produced an
+                // infinite ERR_TOO_MANY_REDIRECTS loop on /api/projects/:id/git/log
+                // because the `?worktreePath=...&limit=50` query string contains
+                // `t=` inside `limit=`, but `searchParams.delete("t")` had nothing
+                // to remove, so the redirect target equaled the source URL.
+                if (reqUrl.searchParams.has("t")) {
+                    setParasorAuthCookie(c, this.token, reqUrl);
+                    reqUrl.searchParams.delete("t");
+                    return c.redirect(reqUrl.pathname + (reqUrl.search || ""));
+                }
+                return next();
+            }
+            return c.json({ error: "Unauthorized" }, 401);
+        };
+    }
+    loadOrGenerate() {
+        try {
+            const existing = readFileSync(this.tokenPath, "utf-8").trim();
+            if (existing.length >= 32)
+                return existing;
+        }
+        catch {
+            // File doesn't exist or can't be read
+        }
+        return this.generate();
+    }
+    generate(persist = true) {
+        const token = randomBytes(32).toString("hex");
+        if (persist) {
+            writeFileSync(this.tokenPath, token, { mode: 0o600 });
+            chmodSync(this.tokenPath, 0o600);
+        }
+        return token;
+    }
+}
+function isInCidr(ip, cidr) {
+    const [cidrIp, bits] = cidr.includes("/") ? cidr.split("/") : [cidr, "32"];
+    const mask = ~(2 ** (32 - Number(bits)) - 1) >>> 0;
+    const ipNum = ip.split(".").reduce((acc, oct) => (acc << 8) | Number(oct), 0) >>> 0;
+    const cidrNum = cidrIp.split(".").reduce((acc, oct) => (acc << 8) | Number(oct), 0) >>> 0;
+    return (ipNum & mask) === (cidrNum & mask);
+}
+//# sourceMappingURL=token.js.map

package/server/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAExD,MAAM,UAAU,oBAAoB,CAClC,CAAU,EACV,KAAa,EACb,GAAQ;IAER,SAAS,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ;KAClC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,OAAO,SAAS;IACX,KAAK,CAAS;IACN,SAAS,CAAS;IAEnC,YAAY,IAAmB;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,YAAY,CACV,MAAc,EACd,YAAgC;QAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC1D,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CACR,IAAoC,EACpC,YAAuB,EACvB,UAAU,GAAG,KAAK;QAElB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,IAAI,EAAE,CAAC;YAEhD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,MAAM,aAAa,GAAI,CAAC,CAAC,GAA8C;oBACrE,EAAE,aAAa,CAAC;gBAClB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,MAAM,QAAQ,GAAG,UAAU;oBACzB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;wBACvD,aAAa,CAAC;oBAChB,CAAC,CAAC,aAAa,CAAC;gBAClB,IACE,QAAQ;oBACR,YAAY,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EACtD,CAAC;oBACD,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAEjE,IAAI,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,6DAA6D;gBAC7D,gEAAgE;gBAChE,wDAAwD;gBACxD,4DAA4D;gBAC5D,oEAAoE;gBACpE,iEAAiE;gBACjE,mEAAmE;gBACnE,4DAA4D;gBAC5D,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAC5C,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC,CAAC;IACJ,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;gBAAE,OAAO,QAAQ,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAEO,QAAQ,CAAC,OAAO,GAAG,IAAI;QAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,IAAY;IACxC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GACT,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,OAAO,GACX,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5E,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC"}

package/server/bootstrap/create-app-server.d.ts

@@ -0,0 +1,49 @@
+import type { AgentState } from "@parasor/shared";
+import { Hono } from "hono";
+import type { AgentDetector } from "../agent-detector/detector.js";
+import type { PairingTokenStore } from "../auth/pairing-token.js";
+import type { TokenAuth } from "../auth/token.js";
+import type { AgentStatusRecorder } from "../debug/agent-status-recorder.js";
+import type { TerminalTraceRecorder } from "../debug/terminal-trace-recorder.js";
+import type { FilesystemService } from "../fs/service.js";
+import type { UploadStaging } from "../fs/upload-staging.js";
+import type { PtyHost } from "../pty/host.js";
+import type { AppStateStore } from "../state/app-state.js";
+import type { ProjectManager } from "../state/project-manager.js";
+import type { ServerNoticesStore } from "../state/server-notices.js";
+import type { WorktreeCache } from "../state/worktree-cache.js";
+import { type EventBus } from "../ws/events.js";
+import type { ProjectRuntime } from "./project-runtime.js";
+export type AuthMode = "token" | "allowlist" | "none";
+export interface WsKeepaliveConfig {
+    pingIntervalMs: number;
+    pongTimeoutMs: number;
+}
+export interface CreateAppServerDeps {
+    authMode: AuthMode;
+    tokenAuth: TokenAuth;
+    pairingTokens: PairingTokenStore;
+    ptyManager: PtyHost;
+    agentDetector: AgentDetector;
+    getAgentStates: () => Record<string, AgentState>;
+    debugRecorder: AgentStatusRecorder;
+    terminalTraceRecorder: TerminalTraceRecorder;
+    eventBus: EventBus;
+    projectManager: ProjectManager;
+    appStateStore: AppStateStore;
+    serverNoticesStore: ServerNoticesStore;
+    worktreeCache: WorktreeCache;
+    projectRuntime: ProjectRuntime;
+    uploadStaging: UploadStaging;
+    reconcileWorktrees?: (projectId: string, prefetched?: import("@parasor/shared").Worktree[]) => Promise<void>;
+    getFilesystemService: (projectId: string, worktreePath?: string) => FilesystemService | null;
+    webDistPath: string;
+    allowedOrigins: Set<string>;
+    wsKeepalive?: WsKeepaliveConfig;
+    onServiceConfigChanged: (config: import("@parasor/shared").ServiceConfig) => void;
+}
+export declare function createAppServer({ authMode, tokenAuth, pairingTokens, ptyManager, agentDetector, getAgentStates, debugRecorder, terminalTraceRecorder, eventBus, projectManager, appStateStore, serverNoticesStore, worktreeCache, projectRuntime, uploadStaging, reconcileWorktrees, getFilesystemService, webDistPath, allowedOrigins, wsKeepalive, onServiceConfigChanged, }: CreateAppServerDeps): {
+    app: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+    injectWebSocket: (server: import("node:http").Server | import("node:http2").Http2Server | import("node:http2").Http2SecureServer) => void;
+};
+//# sourceMappingURL=create-app-server.d.ts.map

package/server/bootstrap/create-app-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-app-server.d.ts","sourceRoot":"","sources":["../../src/bootstrap/create-app-server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAkB9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,KAAK,QAAQ,EAA4B,MAAM,iBAAiB,CAAC;AAO1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,aAAa,EAAE,iBAAiB,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,aAAa,EAAE,mBAAmB,CAAC;IACnC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,kBAAkB,CAAC,EAAE,CACnB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,OAAO,iBAAiB,EAAE,QAAQ,EAAE,KAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,oBAAoB,EAAE,CACpB,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,KAClB,iBAAiB,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,sBAAsB,EAAE,CACtB,MAAM,EAAE,OAAO,iBAAiB,EAAE,aAAa,KAC5C,IAAI,CAAC;CACX;AAED,wBAAgB,eAAe,CAAC,EAC9B,QAAQ,EACR,SAAS,EACT,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,cAAc,EACd,WAAW,EACX,sBAAsB,GACvB,EAAE,mBAAmB;;;EAkNrB"}

package/server/bootstrap/create-app-server.js

@@ -0,0 +1,154 @@
+import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { createNodeWebSocket } from "@hono/node-ws";
+import { Hono } from "hono";
+import { originMiddleware } from "../auth/origin.js";
+import { createTokenExchangeMiddleware } from "../auth/token-exchange.js";
+import { FontInstaller } from "../fonts/installer.js";
+import { createFontRoutes } from "../fonts/routes.js";
+import { createDebugAgentStatusRoute } from "../routes/debug-agent-status.js";
+import { createDebugDiagnosticsRoute } from "../routes/debug-diagnostics.js";
+import { createDebugTerminalTraceRoute } from "../routes/debug-terminal-trace.js";
+import { createDropRoutes } from "../routes/drops.js";
+import { createFileUploadRoutes } from "../routes/file-uploads.js";
+import { createFileRoutes } from "../routes/files.js";
+import { createFilesystemRoutes } from "../routes/filesystem.js";
+import { createGitRoutes } from "../routes/git.js";
+import { createHealthzRoute } from "../routes/healthz.js";
+import { createHookRoute } from "../routes/hook.js";
+import { createIdeCommandRoutes } from "../routes/ide-commands.js";
+import { createOpenRoute } from "../routes/open.js";
+import { createPaneCommandRoutes } from "../routes/pane-commands.js";
+import { createProjectRoutes } from "../routes/projects.js";
+import { createServerNoticesRoutes } from "../routes/server-notices.js";
+import { createServiceConfigRoutes } from "../routes/service-config.js";
+import { createSessionRoutes } from "../routes/sessions.js";
+import { handleEventClientMessage } from "../ws/events.js";
+import { attachKeepalive } from "../ws/keepalive.js";
+import { cleanupTerminalRelay, handleTerminalMessage, setupTerminalRelay, } from "../ws/terminal.js";
+export function createAppServer({ authMode, tokenAuth, pairingTokens, ptyManager, agentDetector, getAgentStates, debugRecorder, terminalTraceRecorder, eventBus, projectManager, appStateStore, serverNoticesStore, worktreeCache, projectRuntime, uploadStaging, reconcileWorktrees, getFilesystemService, webDistPath, allowedOrigins, wsKeepalive, onServiceConfigChanged, }) {
+    const app = new Hono();
+    const { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app });
+    const keepaliveConfig = wsKeepalive ?? {
+        pingIntervalMs: 20_000,
+        pongTimeoutMs: 10_000,
+    };
+    app.use("*", createTokenExchangeMiddleware({
+        mode: authMode,
+        tokenAuth,
+        pairingTokens,
+    }));
+    app.route("/healthz", createHealthzRoute());
+    app.route("/hook", createHookRoute({ ptyManager, agentDetector, debugRecorder }));
+    app.use("/api/*", tokenAuth.middleware(authMode));
+    app.use("/ws/*", originMiddleware({ allowed: allowedOrigins }));
+    app.use("/ws/*", tokenAuth.middleware(authMode));
+    app.use("/api/*", async (c, next) => {
+        await next();
+        c.header("X-Content-Type-Options", "nosniff");
+        c.header("X-Frame-Options", "DENY");
+    });
+    app.route("/api/projects", createProjectRoutes(projectManager, eventBus, ptyManager, appStateStore, worktreeCache, reconcileWorktrees));
+    app.route("/api/projects", createDropRoutes({
+        projectManager,
+        appStateStore,
+        ptyManager,
+        uploadStaging,
+    }));
+    app.route("/api/projects", createFileUploadRoutes({ projectManager, appStateStore }));
+    app.route("/api/projects", createGitRoutes({ projectManager, worktreeCache, projectRuntime }));
+    app.route("/api/sessions", createSessionRoutes(ptyManager, eventBus, appStateStore, terminalTraceRecorder));
+    app.route("/api/fs", createFilesystemRoutes());
+    app.route("/api/open", createOpenRoute(eventBus));
+    app.route("/api/pane-commands", createPaneCommandRoutes({ appStateStore, eventBus }));
+    app.route("/api/ide-commands", createIdeCommandRoutes({ appStateStore, eventBus }));
+    app.route("/api/debug/agent-status", createDebugAgentStatusRoute(debugRecorder, getAgentStates));
+    app.route("/api/debug/diagnostics", createDebugDiagnosticsRoute({
+        terminalTraceRecorder,
+    }));
+    app.route("/api/debug/terminal-trace", createDebugTerminalTraceRoute({
+        recorder: terminalTraceRecorder,
+        ptyManager,
+        eventBus,
+        appStateStore,
+        projectManager,
+    }));
+    app.route("/api/files", createFileRoutes(projectManager, getFilesystemService, {
+        isWritable: (projectId) => !projectManager.get(projectId)?.readOnly,
+    }));
+    app.route("/api/fonts", createFontRoutes(new FontInstaller()));
+    app.route("/api/service-config", createServiceConfigRoutes({
+        appStateStore,
+        eventBus,
+        onConfigChanged: onServiceConfigChanged,
+    }));
+    app.route("/api/notices", createServerNoticesRoutes(serverNoticesStore));
+    app.get("/api/health", (c) => c.json({ status: "ok" }));
+    app.get("/api/auth/verify", (c) => c.json({ ok: true }));
+    app.get("/ws/terminal/:id", upgradeWebSocket((c) => {
+        const sessionId = c.req.param("id");
+        if (!sessionId)
+            throw new Error("missing terminal session id");
+        const clientId = c.req.query("clientId") ?? randomUUID();
+        let wsInstance;
+        let disposeKeepalive = null;
+        return {
+            onOpen(_event, ws) {
+                wsInstance = ws;
+                const raw = ws.raw;
+                if (raw)
+                    disposeKeepalive = attachKeepalive(raw, keepaliveConfig);
+                setupTerminalRelay(ws, sessionId, clientId, ptyManager, terminalTraceRecorder);
+            },
+            onMessage(event, ws) {
+                void handleTerminalMessage(ws, sessionId, clientId, ptyManager, event, terminalTraceRecorder);
+            },
+            onClose() {
+                disposeKeepalive?.();
+                disposeKeepalive = null;
+                if (wsInstance) {
+                    cleanupTerminalRelay(wsInstance, sessionId, clientId, ptyManager, terminalTraceRecorder);
+                }
+            },
+        };
+    }));
+    app.get("/ws/events", upgradeWebSocket(() => {
+        let disposeKeepalive = null;
+        return {
+            async onOpen(_event, ws) {
+                const raw = ws.raw;
+                if (raw)
+                    disposeKeepalive = attachKeepalive(raw, keepaliveConfig);
+                await eventBus.addClient(ws);
+            },
+            onMessage(event, ws) {
+                handleEventClientMessage(ws, event.data);
+            },
+            onClose(_event, ws) {
+                disposeKeepalive?.();
+                disposeKeepalive = null;
+                eventBus.removeClient(ws);
+            },
+        };
+    }));
+    const serveIndex = async (c) => {
+        const html = await readFile(join(webDistPath, "index.html"), "utf8");
+        // Clickjacking defense for the app shell. sameSite=Strict already stops a
+        // cross-site frame from carrying the token, but deny framing outright too.
+        // `frame-ancestors 'none'` is the only CSP directive set here, so it does
+        // not constrain the app's own script/style/font/WebGL loading.
+        c.header("X-Frame-Options", "DENY");
+        c.header("Content-Security-Policy", "frame-ancestors 'none'");
+        return c.html(html);
+    };
+    app.get("/", serveIndex);
+    app.get("/monitor", serveIndex);
+    app.get("/sessions/*", serveIndex);
+    app.get("/panes/*", serveIndex);
+    app.get("/worktree", serveIndex);
+    app.use("/*", serveStatic({ root: webDistPath }));
+    return { app, injectWebSocket };
+}
+//# sourceMappingURL=create-app-server.js.map

package/server/bootstrap/create-app-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-app-server.js","sourceRoot":"","sources":["../../src/bootstrap/create-app-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAItD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,EAAiB,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AA0C3B,MAAM,UAAU,eAAe,CAAC,EAC9B,QAAQ,EACR,SAAS,EACT,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,cAAc,EACd,WAAW,EACX,sBAAsB,GACF;IACpB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,WAAW,IAAI;QACrC,cAAc,EAAE,MAAM;QACtB,aAAa,EAAE,MAAM;KACtB,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,GAAG,EACH,6BAA6B,CAAC;QAC5B,IAAI,EAAE,QAAQ;QACd,SAAS;QACT,aAAa;KACd,CAAC,CACH,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CACP,OAAO,EACP,eAAe,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAC9D,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAChE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CACP,eAAe,EACf,mBAAmB,CACjB,cAAc,EACd,QAAQ,EACR,UAAU,EACV,aAAa,EACb,aAAa,EACb,kBAAkB,CACnB,CACF,CAAC;IACF,GAAG,CAAC,KAAK,CACP,eAAe,EACf,gBAAgB,CAAC;QACf,cAAc;QACd,aAAa;QACb,UAAU;QACV,aAAa;KACd,CAAC,CACH,CAAC;IACF,GAAG,CAAC,KAAK,CACP,eAAe,EACf,sBAAsB,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAC1D,CAAC;IACF,GAAG,CAAC,KAAK,CACP,eAAe,EACf,eAAe,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CACnE,CAAC;IACF,GAAG,CAAC,KAAK,CACP,eAAe,EACf,mBAAmB,CACjB,UAAU,EACV,QAAQ,EACR,aAAa,EACb,qBAAqB,CACtB,CACF,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,KAAK,CACP,oBAAoB,EACpB,uBAAuB,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CACrD,CAAC;IACF,GAAG,CAAC,KAAK,CACP,mBAAmB,EACnB,sBAAsB,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CACpD,CAAC;IACF,GAAG,CAAC,KAAK,CACP,yBAAyB,EACzB,2BAA2B,CAAC,aAAa,EAAE,cAAc,CAAC,CAC3D,CAAC;IACF,GAAG,CAAC,KAAK,CACP,wBAAwB,EACxB,2BAA2B,CAAC;QAC1B,qBAAqB;KACtB,CAAC,CACH,CAAC;IACF,GAAG,CAAC,KAAK,CACP,2BAA2B,EAC3B,6BAA6B,CAAC;QAC5B,QAAQ,EAAE,qBAAqB;QAC/B,UAAU;QACV,QAAQ;QACR,aAAa;QACb,cAAc;KACf,CAAC,CACH,CAAC;IACF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,gBAAgB,CAAC,cAAc,EAAE,oBAAoB,EAAE;QACrD,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ;KACpE,CAAC,CACH,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,gBAAgB,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,KAAK,CACP,qBAAqB,EACrB,yBAAyB,CAAC;QACxB,aAAa;QACb,QAAQ;QACR,eAAe,EAAE,sBAAsB;KACxC,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,yBAAyB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEzD,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;QACzD,IAAI,UAA8B,CAAC;QACnC,IAAI,gBAAgB,GAAwB,IAAI,CAAC;QACjD,OAAO;YACL,MAAM,CAAC,MAAM,EAAE,EAAE;gBACf,UAAU,GAAG,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;gBACnB,IAAI,GAAG;oBAAE,gBAAgB,GAAG,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBAClE,kBAAkB,CAChB,EAAE,EACF,SAAS,EACT,QAAQ,EACR,UAAU,EACV,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,KAAK,EAAE,EAAE;gBACjB,KAAK,qBAAqB,CACxB,EAAE,EACF,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,gBAAgB,EAAE,EAAE,CAAC;gBACrB,gBAAgB,GAAG,IAAI,CAAC;gBACxB,IAAI,UAAU,EAAE,CAAC;oBACf,oBAAoB,CAClB,UAAU,EACV,SAAS,EACT,QAAQ,EACR,UAAU,EACV,qBAAqB,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,YAAY,EACZ,gBAAgB,CAAC,GAAG,EAAE;QACpB,IAAI,gBAAgB,GAAwB,IAAI,CAAC;QACjD,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE;gBACrB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;gBACnB,IAAI,GAAG;oBAAE,gBAAgB,GAAG,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBAClE,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,SAAS,CAAC,KAAK,EAAE,EAAE;gBACjB,wBAAwB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,MAAM,EAAE,EAAE;gBAChB,gBAAgB,EAAE,EAAE,CAAC;gBACrB,gBAAgB,GAAG,IAAI,CAAC;gBACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,CAAU,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,+DAA+D;QAC/D,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAEjC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAElD,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC"}

package/server/bootstrap/project-runtime.d.ts

@@ -0,0 +1,29 @@
+import type { GitState, WsEventMessage } from "@parasor/shared";
+import { FilesystemService } from "../fs/service.js";
+import type { ProjectManager } from "../state/project-manager.js";
+import type { WorktreeCache } from "../state/worktree-cache.js";
+import type { EventBus } from "../ws/events.js";
+export interface ProjectRuntime {
+    /**
+     * Returns the filesystem service for the project's main checkout, or for a
+     * specific linked worktree when `worktreePath` is supplied. Worktree paths
+     * are validated against {@link WorktreeCache} so callers can route untrusted
+     * query input here without separate fence checks. `null` when the project
+     * does not exist or the worktree is not registered for that project.
+     */
+    getFilesystemService(projectId: string, worktreePath?: string): FilesystemService | null;
+    getGitStates(): Record<string, Record<string, GitState | null>>;
+    activatePersistedProjects(projectIds: Iterable<string>): void;
+    handleBroadcast(message: WsEventMessage): void;
+    handleSessionEnded(projectId: string): void;
+    pollGitChanges(): Promise<void>;
+    refreshGitState(projectId: string, worktreePath: string): Promise<void>;
+    dispose(): Promise<void>;
+}
+export interface CreateProjectRuntimeDeps {
+    projectManager: ProjectManager;
+    eventBus: EventBus;
+    worktreeCache: WorktreeCache;
+}
+export declare function createProjectRuntime({ projectManager, eventBus, worktreeCache, }: CreateProjectRuntimeDeps): ProjectRuntime;
+//# sourceMappingURL=project-runtime.d.ts.map

package/server/bootstrap/project-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-runtime.d.ts","sourceRoot":"","sources":["../../src/bootstrap/project-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,oBAAoB,CAClB,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,iBAAiB,GAAG,IAAI,CAAC;IAC5B,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC9D,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,aAAa,CAAC;CAC9B;AAMD,wBAAgB,oBAAoB,CAAC,EACnC,cAAc,EACd,QAAQ,EACR,aAAa,GACd,EAAE,wBAAwB,GAAG,cAAc,CAuR3C"}

package/server/bootstrap/project-runtime.js

@@ -0,0 +1,253 @@
+import { FileWatcher } from "../fs/file-watcher.js";
+import { GitWatcher } from "../fs/git-watcher.js";
+import { FilesystemService } from "../fs/service.js";
+import { WatcherLifecycle } from "../fs/watcher-lifecycle.js";
+function watcherKey(projectId, worktreePath) {
+    return `${projectId}|${worktreePath}`;
+}
+export function createProjectRuntime({ projectManager, eventBus, worktreeCache, }) {
+    const fsServices = new Map();
+    // Per-worktree FS service cache, keyed by `${projectId}|${worktreePath}`.
+    // Kept separate from `fsServices` so the project-root service (used by
+    // FileWatcher's `.gitignore` reload + isIgnored callback) keeps its
+    // simple `projectId`-only key and existing semantics.
+    const worktreeFsServices = new Map();
+    const fileWatchers = new Map();
+    const gitWatcher = new GitWatcher();
+    // Per-key serialization for watcher start/stop. `worktree-created` and
+    // `worktree-removed` can land in either order, even back-to-back for the
+    // same path. Without serialization a removal that arrives mid-`start()`
+    // would miss the map entry, and a re-creation that arrives mid-`stop()`
+    // would spawn a second native subscription before the old one shuts down.
+    // Chaining ops by key gives both events a consistent view of the watcher
+    // state.
+    const watcherOps = new Map();
+    function chainWatcherOp(key, op) {
+        const prev = watcherOps.get(key) ?? Promise.resolve();
+        const next = prev.catch(() => undefined).then(op);
+        watcherOps.set(key, next);
+        void next.finally(() => {
+            if (watcherOps.get(key) === next)
+                watcherOps.delete(key);
+        });
+        return next;
+    }
+    // Debounced per-worktree git-state recompute on regular file changes.
+    // FileWatcher only triggers `broadcastGitState` for `.git/HEAD/index/refs`
+    // edits, but a plain save (e.g. README.md) also flips dirtyCount and the
+    // user expects the counter to update sub-second -- not on the next 10s poll.
+    const pendingGitDiff = new Map();
+    const GIT_DIFF_DEBOUNCE_MS = 200;
+    function scheduleGitDiff(projectId, worktreePath) {
+        const key = watcherKey(projectId, worktreePath);
+        const existing = pendingGitDiff.get(key);
+        if (existing)
+            clearTimeout(existing);
+        pendingGitDiff.set(key, setTimeout(() => {
+            pendingGitDiff.delete(key);
+            void broadcastGitState(projectId, worktreePath);
+        }, GIT_DIFF_DEBOUNCE_MS));
+    }
+    function getFilesystemService(projectId, worktreePath) {
+        const project = projectManager.get(projectId);
+        if (!project)
+            return null;
+        // No worktree override (or matches project root) -> return the cached
+        // project-root service. This is also the watcher-facing path so its
+        // `.gitignore` instance is preserved across calls.
+        if (!worktreePath || worktreePath === project.path) {
+            const cached = fsServices.get(projectId);
+            if (cached)
+                return cached;
+            const service = new FilesystemService(project.path);
+            fsServices.set(projectId, service);
+            return service;
+        }
+        // Untrusted input fence: only resolve to a worktree when it is
+        // currently registered for this project. Unknown paths fall back to
+        // the project root rather than spawning an arbitrary FS service.
+        const worktrees = worktreeCache.get()[projectId] ?? [];
+        if (!worktrees.some((w) => w.path === worktreePath)) {
+            return getFilesystemService(projectId);
+        }
+        const key = `${projectId}|${worktreePath}`;
+        const cached = worktreeFsServices.get(key);
+        if (cached)
+            return cached;
+        const service = new FilesystemService(worktreePath);
+        worktreeFsServices.set(key, service);
+        return service;
+    }
+    async function broadcastGitState(projectId, worktreePath) {
+        const { state, changed } = await gitWatcher.checkAndDiff(projectId, worktreePath);
+        if (changed) {
+            eventBus.broadcast({ type: "git-state", projectId, worktreePath, state });
+        }
+    }
+    /**
+     * Returns every worktree path that should be watched for `projectId`. The
+     * project's main checkout path is always included, even when the worktree
+     * cache only lists linked worktrees.
+     */
+    function projectWorktreePaths(projectId) {
+        const project = projectManager.get(projectId);
+        if (!project)
+            return [];
+        const paths = new Set([project.path]);
+        for (const wt of worktreeCache.get()[projectId] ?? []) {
+            paths.add(wt.path);
+        }
+        return [...paths];
+    }
+    function spawnWatcher(projectId, worktreePath) {
+        const key = watcherKey(projectId, worktreePath);
+        return chainWatcherOp(key, async () => {
+            if (fileWatchers.has(key))
+                return;
+            // Filesystem ignore rules live on the project's main worktree (the
+            // only one that owns `.gitignore` semantics for parasor's filetree).
+            // Linked worktrees share the same FilesystemService instance.
+            const fsService = getFilesystemService(projectId);
+            const watcher = new FileWatcher(worktreePath, (event, path) => {
+                eventBus.broadcast({ type: "file-change", projectId, event, path });
+                scheduleGitDiff(projectId, worktreePath);
+            }, () => {
+                const service = fsServices.get(projectId);
+                service?.reloadIgnore();
+                eventBus.broadcast({ type: "gitignore-updated", projectId });
+            }, async () => {
+                await broadcastGitState(projectId, worktreePath);
+            }, (relPath, isDir) => fsService?.isIgnored(relPath, isDir) ?? false);
+            await watcher.start();
+            fileWatchers.set(key, watcher);
+            await broadcastGitState(projectId, worktreePath);
+        });
+    }
+    function teardownWatcher(projectId, worktreePath) {
+        const key = watcherKey(projectId, worktreePath);
+        return chainWatcherOp(key, async () => {
+            const watcher = fileWatchers.get(key);
+            if (watcher) {
+                fileWatchers.delete(key);
+                await watcher.stop();
+            }
+            const pending = pendingGitDiff.get(key);
+            if (pending) {
+                clearTimeout(pending);
+                pendingGitDiff.delete(key);
+            }
+            worktreeFsServices.delete(key);
+            gitWatcher.clearWorktree(projectId, worktreePath);
+        });
+    }
+    async function tearDownWatchers(projectId) {
+        const prefix = `${projectId}|`;
+        for (const [key, timer] of pendingGitDiff) {
+            if (!key.startsWith(prefix))
+                continue;
+            clearTimeout(timer);
+            pendingGitDiff.delete(key);
+        }
+        const tasks = [];
+        for (const [key, watcher] of fileWatchers) {
+            if (!key.startsWith(prefix))
+                continue;
+            tasks.push(watcher.stop().finally(() => {
+                fileWatchers.delete(key);
+            }));
+        }
+        await Promise.all(tasks);
+        gitWatcher.clearProject(projectId);
+    }
+    const watcherLifecycle = new WatcherLifecycle({
+        onActivate: async (projectId) => {
+            const project = projectManager.get(projectId);
+            if (!project)
+                return;
+            for (const worktreePath of projectWorktreePaths(projectId)) {
+                await spawnWatcher(projectId, worktreePath);
+            }
+        },
+        onSuspend: async (projectId) => {
+            await tearDownWatchers(projectId);
+        },
+    });
+    return {
+        getFilesystemService,
+        getGitStates: () => gitWatcher.getAllCached(),
+        activatePersistedProjects(projectIds) {
+            for (const projectId of projectIds) {
+                void watcherLifecycle.ensureActive(projectId);
+            }
+        },
+        handleBroadcast(message) {
+            if (message.type === "project-created") {
+                void watcherLifecycle.ensureActive(message.project.id);
+                return;
+            }
+            if (message.type === "worktree-created") {
+                if (watcherLifecycle.isActive(message.projectId)) {
+                    void spawnWatcher(message.projectId, message.worktree.path);
+                }
+                return;
+            }
+            if (message.type === "worktree-removed") {
+                // Stop the watcher and drop the per-worktree FS service so deleted
+                // worktrees do not leak parcel-watcher native handles or cached
+                // FilesystemService instances across the daemon's lifetime. The
+                // teardown is serialized with any in-flight spawn so a removal
+                // landing mid-`watcher.start()` still cleans up after start returns.
+                void teardownWatcher(message.projectId, message.worktreePath);
+                return;
+            }
+            if (message.type === "session-created" ||
+                message.type === "session-restarted") {
+                void watcherLifecycle.onSessionCreated(message.session.projectId);
+                return;
+            }
+            if (message.type === "session-closed") {
+                void watcherLifecycle.onSessionEnded(message.projectId);
+                return;
+            }
+            if (message.type === "project-deleted") {
+                void watcherLifecycle.onProjectDeleted(message.projectId);
+                fsServices.delete(message.projectId);
+                const prefix = `${message.projectId}|`;
+                for (const key of worktreeFsServices.keys()) {
+                    if (key.startsWith(prefix))
+                        worktreeFsServices.delete(key);
+                }
+            }
+        },
+        handleSessionEnded(projectId) {
+            void watcherLifecycle.onSessionEnded(projectId);
+        },
+        async pollGitChanges() {
+            for (const project of projectManager.list()) {
+                if (!watcherLifecycle.isActive(project.id))
+                    continue;
+                for (const worktreePath of projectWorktreePaths(project.id)) {
+                    await broadcastGitState(project.id, worktreePath);
+                }
+            }
+        },
+        async refreshGitState(projectId, worktreePath) {
+            await broadcastGitState(projectId, worktreePath);
+        },
+        async dispose() {
+            watcherLifecycle.dispose();
+            for (const timer of pendingGitDiff.values())
+                clearTimeout(timer);
+            pendingGitDiff.clear();
+            const tasks = [];
+            for (const watcher of fileWatchers.values()) {
+                tasks.push(watcher.stop());
+            }
+            await Promise.all(tasks);
+            fileWatchers.clear();
+            fsServices.clear();
+            worktreeFsServices.clear();
+        },
+    };
+}
+//# sourceMappingURL=project-runtime.js.map