patchwork-os 0.2.0-alpha.34 → 0.2.0-alpha.36

package/dist/inboxRoutes.js

@@ -0,0 +1,114 @@
+/**
+ * Inbox route dispatcher — extracted from src/server.ts.
+ *
+ * Owns `/inbox` (list markdown files in ~/.patchwork/inbox) and
+ * `/inbox/<filename>.md` (read a single inbox file). Server.ts delegates
+ * with a single `tryHandleInboxRoute` call.
+ *
+ * Mechanical lift — handler bodies are byte-identical to the original
+ * block. Pre-extraction grep confirmed zero `this.` references; no
+ * dependency injection was needed.
+ *
+ * Security note: the by-filename route MUST reject paths containing `/`
+ * or `\\` to prevent traversal out of the inbox directory. The check is
+ * preserved verbatim from the original.
+ */
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/**
+ * Try to handle an `/inbox` or `/inbox/<filename>.md` route. Returns true
+ * if the route was dispatched (caller should `return` from the request
+ * handler), false if no route matched.
+ */
+export function tryHandleInboxRoute(req, res, parsedUrl) {
+    if (parsedUrl.pathname === "/inbox" && req.method === "GET") {
+        void (async () => {
+            try {
+                const { readdir, readFile, stat } = await import("node:fs/promises");
+                const inboxDir = path.join(os.homedir(), ".patchwork", "inbox");
+                if (!existsSync(inboxDir)) {
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ items: [] }));
+                    return;
+                }
+                const files = (await readdir(inboxDir)).filter((f) => f.endsWith(".md"));
+                const items = await Promise.all(files.map(async (name) => {
+                    const filePath = path.join(inboxDir, name);
+                    const [content, stats] = await Promise.all([
+                        readFile(filePath, "utf8"),
+                        stat(filePath),
+                    ]);
+                    const stripped = content
+                        .split("\n")
+                        .filter((l) => !l.startsWith("#"))
+                        .join("\n")
+                        .trim();
+                    // `path` intentionally omitted — leaking the absolute filesystem
+                    // path (which includes the user's home dir / username) is a
+                    // low-impact info-disclosure if the dashboard is ever proxied to
+                    // an untrusted client (shared screen, screenshots, browser
+                    // extensions reading the DOM). Callers identify items by `name`,
+                    // and the read endpoint joins it back to inboxDir on the server.
+                    return {
+                        name,
+                        modifiedAt: stats.mtime.toISOString(),
+                        preview: stripped.slice(0, 200),
+                    };
+                }));
+                items.sort((a, b) => new Date(b.modifiedAt).getTime() - new Date(a.modifiedAt).getTime());
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ items }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({
+                    error: err instanceof Error ? err.message : String(err),
+                }));
+            }
+        })();
+        return true;
+    }
+    const inboxFileMatch = parsedUrl.pathname?.match(/^\/inbox\/([^/]+\.md)$/);
+    if (inboxFileMatch && req.method === "GET") {
+        void (async () => {
+            try {
+                const { readFile, stat } = await import("node:fs/promises");
+                const filename = decodeURIComponent(inboxFileMatch[1] ?? "");
+                // Prevent path traversal — filename must not contain directory separators
+                if (filename.includes("/") || filename.includes("\\")) {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Invalid filename" }));
+                    return;
+                }
+                const filePath = path.join(os.homedir(), ".patchwork", "inbox", filename);
+                const [content, stats] = await Promise.all([
+                    readFile(filePath, "utf8"),
+                    stat(filePath),
+                ]);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({
+                    name: filename,
+                    content,
+                    modifiedAt: stats.mtime.toISOString(),
+                }));
+            }
+            catch (err) {
+                const code = err.code;
+                if (code === "ENOENT") {
+                    res.writeHead(404, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Not found" }));
+                }
+                else {
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        error: err instanceof Error ? err.message : String(err),
+                    }));
+                }
+            }
+        })();
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=inboxRoutes.js.map

package/dist/inboxRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inboxRoutes.js","sourceRoot":"","sources":["../src/inboxRoutes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,GAAmB,EACnB,SAAc;IAEd,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5D,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;gBAChE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;oBACvC,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACnD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAClB,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAC3C,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;wBAC1B,IAAI,CAAC,QAAQ,CAAC;qBACf,CAAC,CAAC;oBACH,MAAM,QAAQ,GAAG,OAAO;yBACrB,KAAK,CAAC,IAAI,CAAC;yBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;yBACjC,IAAI,CAAC,IAAI,CAAC;yBACV,IAAI,EAAE,CAAC;oBACV,iEAAiE;oBACjE,4DAA4D;oBAC5D,iEAAiE;oBACjE,2DAA2D;oBAC3D,iEAAiE;oBACjE,iEAAiE;oBACjE,OAAO;wBACL,IAAI;wBACJ,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;wBACrC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBAChC,CAAC;gBACJ,CAAC,CAAC,CACH,CAAC;gBACF,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CACtE,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3E,IAAI,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7D,0EAA0E;gBAC1E,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;oBACvD,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,EAAE,CAAC,OAAO,EAAE,EACZ,YAAY,EACZ,OAAO,EACP,QAAQ,CACT,CAAC;gBACF,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;oBAC1B,IAAI,CAAC,QAAQ,CAAC;iBACf,CAAC,CAAC;gBACH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,QAAQ;oBACd,OAAO;oBACP,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;iBACtC,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;gBACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}