tower-studio 0.1.1 → 0.1.3

package/src/lib/i18n.tsx

@@ -0,0 +1,64 @@
+"use client";
+
+import { createContext, useContext, useState, useCallback, useEffect, type ReactNode } from "react";
+import { zh } from "./i18n/zh";
+import { en } from "./i18n/en";
+export type { TranslationKey } from "./i18n/types";
+
+export type Locale = "zh" | "en";
+
+const translations = { zh, en };
+
+type TranslationKey = keyof typeof zh;
+
+interface I18nContextValue {
+  locale: Locale;
+  setLocale: (locale: Locale) => void;
+  t: (key: TranslationKey, vars?: Record<string, string>) => string;
+}
+
+const I18nContext = createContext<I18nContextValue | null>(null);
+
+export function I18nProvider({ children }: { children: ReactNode }) {
+  // Always start with "zh" on both server and client to avoid hydration mismatch.
+  // The real locale is read from localStorage in useEffect after mount.
+  const [locale, setLocaleState] = useState<Locale>("zh");
+
+  useEffect(() => {
+    const stored = localStorage.getItem("locale") as Locale | null;
+    if (stored && stored !== locale) {
+      setLocaleState(stored);
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  const setLocale = useCallback((l: Locale) => {
+    setLocaleState(l);
+    localStorage.setItem("locale", l);
+  }, []);
+
+  const t = useCallback(
+    (key: TranslationKey, vars?: Record<string, string>) => {
+      let str = translations[locale][key] ?? key;
+      if (vars) {
+        for (const [k, v] of Object.entries(vars)) {
+          str = str.replace(`{${k}}`, v);
+        }
+      }
+      return str;
+    },
+    [locale]
+  );
+
+  return (
+    <I18nContext.Provider value={{ locale, setLocale, t }}>
+      {children}
+    </I18nContext.Provider>
+  );
+}
+
+export function useI18n() {
+  const ctx = useContext(I18nContext);
+  if (!ctx) throw new Error("useI18n must be used within I18nProvider");
+  return ctx;
+}

package/src/lib/init-tower.ts

@@ -0,0 +1,129 @@
+/**
+ * Ensure .tower/ directory exists with assistant persona and skill files.
+ * Called once on server startup via instrumentation.ts.
+ * Idempotent — skips files that already exist.
+ */
+
+import { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { getAssistantDir } from "./tower-dir";
+
+const CLAUDE_MD_CONTENT = `# Tower Assistant
+
+你是 Tower Assistant — Tower 任务管理平台的内置 AI 操作员。
+
+## 身份
+
+- 你是一个**任务管理操作员**，不是编程助手
+- 你通过 Tower MCP 工具帮助用户管理工作区、项目、任务
+- 你**不能**读写文件、运行命令、编辑代码、搜索网页
+- 如果用户请求你无法完成的操作，告诉他们需要通过开发 MCP 扩展来支持
+
+## 回复风格
+
+- 使用用户的语言回复（中文问中文答，英文问英文答）
+- 简洁明了，不要冗长的解释
+- 主动使用工具查询信息，而不是猜测
+- 当用户问"你能做什么"时，只列出 Tower MCP 工具提供的能力
+`;
+
+export function ensureTowerDir(): string {
+  const assistantDir = getAssistantDir();
+  const claudeMd = join(assistantDir, "CLAUDE.md");
+  const root = process.cwd();
+  const skillSrc = join(root, "skills", "tower", "SKILL.md");
+  const skillDestDir = join(assistantDir, ".claude", "skills", "tower");
+  const skillDest = join(skillDestDir, "SKILL.md");
+
+  // 2. Ensure CLAUDE.md exists
+  if (!existsSync(claudeMd)) {
+    writeFileSync(claudeMd, CLAUDE_MD_CONTENT, "utf-8");
+    console.error(`[init-tower] Created ${claudeMd}`);
+  }
+
+  // 3. Copy SKILL.md from source if missing
+  if (existsSync(skillSrc) && !existsSync(skillDest)) {
+    mkdirSync(skillDestDir, { recursive: true });
+    copyFileSync(skillSrc, skillDest);
+    console.error(`[init-tower] Copied SKILL.md → ${skillDestDir}`);
+  }
+
+  // 4. Auto-install Claude Code hooks (SessionStart + PostToolUse)
+  ensureClaudeHooks();
+
+  return assistantDir;
+}
+
+/**
+ * Ensure Tower hooks are registered in ~/.claude/settings.json.
+ * Idempotent — skips if hooks already present.
+ */
+function ensureClaudeHooks(): void {
+  const settingsPath = join(homedir(), ".claude", "settings.json");
+  // Use forward slashes for cross-platform compatibility in hook commands
+  const root = process.cwd().replace(/\\/g, "/");
+
+  let settings: Record<string, unknown> = {};
+  try {
+    settings = JSON.parse(readFileSync(settingsPath, "utf-8"));
+  } catch {
+    // File doesn't exist or invalid JSON — start fresh
+  }
+
+  const hooks = (settings["hooks"] as Record<string, unknown>) ?? {};
+  let changed = false;
+
+  // SessionStart hook — reports sessionId
+  const sessionStartEntries = (hooks["SessionStart"] as Array<{ hooks: Array<{ command: string }> }>) ?? [];
+  const hasSessionStart = sessionStartEntries.some(
+    (e) => e.hooks?.some((h) => h.command?.includes("session-start-hook.js"))
+  );
+  if (!hasSessionStart) {
+    const hookPath = join(root, "scripts", "session-start-hook.js").replace(/\\/g, "/");
+    sessionStartEntries.push({
+      hooks: [{ command: `node "${hookPath}"`, timeout: 5, type: "command" } as never],
+    });
+    hooks["SessionStart"] = sessionStartEntries;
+    changed = true;
+    console.error("[init-tower] Installed SessionStart hook");
+  }
+
+  // PostToolUse hook — auto-uploads files
+  const postToolEntries = (hooks["PostToolUse"] as Array<{ hooks: Array<{ command: string }> }>) ?? [];
+  const hasPostTool = postToolEntries.some(
+    (e) => e.hooks?.some((h) => h.command?.includes("post-tool-hook.js"))
+  );
+  if (!hasPostTool) {
+    const hookPath = join(root, "scripts", "post-tool-hook.js").replace(/\\/g, "/");
+    postToolEntries.push({
+      hooks: [{ command: `node "${hookPath}"`, timeout: 10, type: "command" } as never],
+      matcher: "Write|Edit|MultiEdit",
+    } as never);
+    hooks["PostToolUse"] = postToolEntries;
+    changed = true;
+    console.error("[init-tower] Installed PostToolUse hook");
+  }
+
+  // Stop hook — notifies Tower when Claude finishes responding
+  const stopEntries = (hooks["Stop"] as Array<{ hooks: Array<{ command: string }> }>) ?? [];
+  const hasStop = stopEntries.some(
+    (e) => e.hooks?.some((h) => h.command?.includes("stop-hook.js"))
+  );
+  if (!hasStop) {
+    const hookPath = join(root, "scripts", "stop-hook.js").replace(/\\/g, "/");
+    stopEntries.push({
+      hooks: [{ command: `node "${hookPath}"`, timeout: 5, type: "command" } as never],
+    });
+    hooks["Stop"] = stopEntries;
+    changed = true;
+    console.error("[init-tower] Installed Stop hook");
+  }
+
+  if (changed) {
+    settings["hooks"] = hooks;
+    const dir = join(homedir(), ".claude");
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
+  }
+}

package/src/lib/instrumentation-tasks.ts

@@ -0,0 +1,116 @@
+import { execFileSync } from "child_process";
+import { initDb, db } from "@/lib/db";
+import { logger } from "@/lib/logger";
+
+const log = logger.create("instrumentation");
+
+/**
+ * Mark stale RUNNING executions as FAILED at server startup.
+ * These are orphaned from a previous server crash or restart.
+ */
+export async function cleanupStaleExecutions() {
+  try {
+    await initDb();
+    const result = await db.taskExecution.updateMany({
+      where: { status: "RUNNING" },
+      data: { status: "FAILED", endedAt: new Date() },
+    });
+    if (result.count > 0) {
+      log.warn(`Cleaned up ${result.count} stale RUNNING execution(s)`);
+    }
+  } catch (error) {
+    log.error("Stale execution cleanup failed", error);
+  }
+}
+
+/**
+ * Ensure the builtin "Tower" label exists.
+ * Used for system workbench tasks (hidden from kanban board).
+ */
+export async function ensureTowerLabel() {
+  try {
+    await initDb();
+    const { TOWER_LABEL_NAME, TOWER_LABEL_COLOR } = await import("@/lib/constants");
+    const existing = await db.label.findFirst({
+      where: { name: TOWER_LABEL_NAME, isBuiltin: true },
+    });
+    if (!existing) {
+      await db.label.create({
+        data: { name: TOWER_LABEL_NAME, color: TOWER_LABEL_COLOR, isBuiltin: true },
+      });
+      log.info("Created builtin Tower label");
+    }
+  } catch (error) {
+    log.error("Failed to ensure Tower label", error);
+  }
+}
+
+/**
+ * Find or create the Tower system task for a project.
+ * Uses label-based lookup (not title) to survive project renames.
+ */
+export async function ensureTowerTask(projectId: string, projectName: string): Promise<string> {
+  const { TOWER_LABEL_NAME } = await import("@/lib/constants");
+
+  // Find by Tower label (rename-safe)
+  const existing = await db.task.findFirst({
+    where: {
+      projectId,
+      labels: { some: { label: { name: TOWER_LABEL_NAME, isBuiltin: true } } },
+    },
+    select: { id: true },
+  });
+  if (existing) return existing.id;
+
+  // Create with label
+  const towerLabel = await db.label.findFirst({
+    where: { name: TOWER_LABEL_NAME, isBuiltin: true },
+  });
+
+  const task = await db.task.create({
+    data: {
+      title: `${projectName}-Tower`,
+      description: `Project workbench for ${projectName}`,
+      projectId,
+      status: "TODO",
+      priority: "LOW",
+      order: 0,
+      ...(towerLabel ? { labels: { create: { labelId: towerLabel.id } } } : {}),
+    },
+    select: { id: true },
+  });
+  return task.id;
+}
+
+/**
+ * Prune orphaned git worktrees for all GIT projects at server startup.
+ * This file is ONLY imported via dynamic import inside instrumentation.ts
+ * when NEXT_RUNTIME === "nodejs", so Node.js modules are safe to use.
+ */
+export async function pruneOrphanedWorktrees() {
+  try {
+    await initDb();
+
+    const gitProjects = await db.project.findMany({
+      where: {
+        type: "GIT",
+        localPath: { not: null },
+      },
+      select: { id: true, localPath: true, name: true },
+    });
+
+    for (const project of gitProjects) {
+      try {
+        execFileSync("git", ["worktree", "prune"], {
+          cwd: project.localPath!,
+          encoding: "utf-8",
+          timeout: 10000,
+        });
+      } catch (error) {
+        log.error(`git worktree prune failed for "${project.name}"`, error, { localPath: project.localPath! });
+      }
+    }
+  } catch (error) {
+    log.error("Worktree prune startup task failed", error);
+  }
+}

package/src/lib/internal-api-guard.ts

@@ -0,0 +1,63 @@
+import { NextRequest, NextResponse } from "next/server";
+
+const LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+const LOOPBACK_IPS = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+const CUID_RE = /^c[a-z0-9]{20,30}$/;
+
+/**
+ * Localhost-only request guard for internal API routes.
+ *
+ * Returns a 403 NextResponse if the request is not from a loopback address.
+ * Returns null if the request is from localhost (caller should proceed).
+ *
+ * Multi-layer detection:
+ * 1. Reject if x-forwarded-for contains any non-loopback IP (proxy bypass prevention)
+ * 2. Check `host` header — must start with `localhost`, `127.0.0.1`, or `[::1]`
+ *
+ * Note: This app is designed for local-only use on a developer machine.
+ * If deployed behind a reverse proxy, add authentication middleware.
+ */
+export function requireLocalhost(request: NextRequest): NextResponse | null {
+  // Layer 1: If x-forwarded-for is present, ALL IPs must be loopback.
+  // Check this FIRST — a proxy sets this header, and if any IP is non-local, reject.
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const ips = forwarded.split(",").map((ip) => ip.trim());
+    const allLoopback = ips.every((ip) => LOOPBACK_IPS.has(ip));
+    if (!allLoopback) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+  }
+
+  // Layer 2: Check host header — must be a loopback address
+  const host = request.headers.get("host") ?? "";
+  const isLocalhostHost = LOOPBACK_HOSTS.some((h) => host.startsWith(h));
+  if (!isLocalhostHost) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  return null;
+}
+
+/**
+ * Validate that a taskId matches CUID format.
+ * Returns a 400 NextResponse if invalid, null if valid.
+ */
+export function validateTaskId(taskId: string): NextResponse | null {
+  if (!CUID_RE.test(taskId)) {
+    return NextResponse.json({ error: "Invalid taskId format" }, { status: 400 });
+  }
+  return null;
+}
+
+/**
+ * Validate that a projectId matches CUID format.
+ * Prevents path-traversal and injection attacks via malformed projectIds.
+ * Returns a 400 NextResponse if invalid, null if valid.
+ */
+export function validateProjectId(projectId: string): NextResponse | null {
+  if (!CUID_RE.test(projectId)) {
+    return NextResponse.json({ error: "Invalid projectId format" }, { status: 400 });
+  }
+  return null;
+}

package/src/lib/logger.ts

@@ -0,0 +1,46 @@
+type LogLevel = "info" | "warn" | "error";
+
+function formatMessage(level: LogLevel, context: string, message: string, meta?: Record<string, unknown>): string {
+  const timestamp = new Date().toISOString();
+  const base = `[${timestamp}] ${level.toUpperCase()} [${context}] ${message}`;
+  if (meta && Object.keys(meta).length > 0) {
+    return `${base} ${JSON.stringify(meta)}`;
+  }
+  return base;
+}
+
+function createLogger(context: string) {
+  return {
+    info(message: string, meta?: Record<string, unknown>) {
+      console.log(formatMessage("info", context, message, meta));
+    },
+    warn(message: string, meta?: Record<string, unknown>) {
+      console.warn(formatMessage("warn", context, message, meta));
+    },
+    error(message: string, error?: unknown, meta?: Record<string, unknown>) {
+      const errMeta = error instanceof Error
+        ? { ...meta, error: error.message, stack: error.stack }
+        : { ...meta, error: String(error) };
+      console.error(formatMessage("error", context, message, errMeta));
+    },
+  };
+}
+
+export const logger = {
+  /** Create a scoped logger for a module/component */
+  create: createLogger,
+
+  // Convenience top-level methods
+  info(message: string, meta?: Record<string, unknown>) {
+    console.log(formatMessage("info", "app", message, meta));
+  },
+  warn(message: string, meta?: Record<string, unknown>) {
+    console.warn(formatMessage("warn", "app", message, meta));
+  },
+  error(message: string, error?: unknown, meta?: Record<string, unknown>) {
+    const errMeta = error instanceof Error
+      ? { ...meta, error: error.message, stack: error.stack }
+      : { ...meta, error: String(error) };
+    console.error(formatMessage("error", "app", message, errMeta));
+  },
+};

package/src/lib/mime-magic.ts

@@ -0,0 +1,67 @@
+/**
+ * Magic-byte MIME detection for image files.
+ *
+ * Validates file type by inspecting raw bytes — never trusts browser-supplied
+ * Content-Type or file.type, which can be spoofed (e.g. SVG-as-PNG XSS).
+ */
+
+interface MimeSignature {
+  mime: string;
+  check: (b: Buffer) => boolean;
+}
+
+const SIGNATURES: MimeSignature[] = [
+  {
+    mime: "image/jpeg",
+    check: (b) => b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff,
+  },
+  {
+    mime: "image/png",
+    check: (b) =>
+      b[0] === 0x89 &&
+      b[1] === 0x50 &&
+      b[2] === 0x4e &&
+      b[3] === 0x47,
+  },
+  {
+    mime: "image/gif",
+    check: (b) => b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46,
+  },
+  {
+    mime: "image/webp",
+    // RIFF at bytes 0-3, WEBP at bytes 8-11
+    check: (b) =>
+      b[0] === 0x52 &&
+      b[1] === 0x49 &&
+      b[2] === 0x46 &&
+      b[3] === 0x46 &&
+      b[8] === 0x57 &&
+      b[9] === 0x45 &&
+      b[10] === 0x42 &&
+      b[11] === 0x50,
+  },
+];
+
+/**
+ * Detect image MIME type from buffer magic bytes.
+ *
+ * Returns null if:
+ * - Buffer is shorter than 12 bytes (not enough to check WEBP signature)
+ * - No known image signature matches
+ */
+export function detectImageMime(buffer: Buffer): string | null {
+  if (buffer.length < 12) return null;
+
+  for (const sig of SIGNATURES) {
+    if (sig.check(buffer)) return sig.mime;
+  }
+  return null;
+}
+
+/** Maps detected MIME type to canonical file extension. */
+export const MIME_TO_EXT: Record<string, string> = {
+  "image/jpeg": ".jpg",
+  "image/png": ".png",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+};