tower-studio 0.1.3 → 0.1.5

package/src/app/api/internal/hooks/upload/route.ts

@@ -1,173 +0,0 @@
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-import { NextRequest, NextResponse } from "next/server";
-import { stat, copyFile } from "fs/promises";
-import { existsSync } from "fs";
-import * as path from "path";
-import { db } from "@/lib/db";
-import { requireLocalhost, validateTaskId } from "@/lib/internal-api-guard";
-import { readConfigValue } from "@/lib/config-reader";
-import { ensureAssetsDir } from "@/lib/file-utils";
-
-const CUID_RE = /^c[a-z0-9]{20,30}$/;
-
-const DEFAULT_UPLOAD_TYPES = [
-  "png", "jpg", "jpeg", "gif", "webp", "svg", "pdf", "md", "txt", "json",
-];
-
-const MIME_MAP: Record<string, string> = {
-  png: "image/png",
-  jpg: "image/jpeg",
-  jpeg: "image/jpeg",
-  gif: "image/gif",
-  webp: "image/webp",
-  svg: "image/svg+xml",
-  pdf: "application/pdf",
-  md: "text/markdown",
-  txt: "text/plain",
-  json: "application/json",
-};
-
-/**
- * GET /api/internal/hooks/upload
- * Returns the configured auto-upload type whitelist.
- */
-export async function GET(request: NextRequest) {
-  const forbidden = requireLocalhost(request);
-  if (forbidden) return forbidden;
-
-  const types = await readConfigValue<string[]>(
-    "hooks.autoUploadTypes",
-    DEFAULT_UPLOAD_TYPES
-  );
-
-  return NextResponse.json({ types });
-}
-
-/**
- * POST /api/internal/hooks/upload
- * Accepts { taskId, filePath } from the PostToolUse hook script.
- * Copies file to project assets directory and creates a DB record.
- */
-export async function POST(request: NextRequest) {
-  const forbidden = requireLocalhost(request);
-  if (forbidden) return forbidden;
-
-  let body: { taskId?: string; filePath?: string };
-  try {
-    body = await request.json();
-  } catch {
-    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
-  }
-
-  const { taskId, filePath } = body;
-
-  if (!taskId || typeof taskId !== "string") {
-    return NextResponse.json({ error: "Missing taskId" }, { status: 400 });
-  }
-
-  const taskIdError = validateTaskId(taskId);
-  if (taskIdError) return taskIdError;
-
-  if (!filePath || typeof filePath !== "string") {
-    return NextResponse.json({ error: "Missing filePath" }, { status: 400 });
-  }
-
-  // Validate file exists
-  let fileStat;
-  try {
-    fileStat = await stat(filePath);
-  } catch {
-    return NextResponse.json({ error: "File not found" }, { status: 404 });
-  }
-
-  // Check file size
-  const maxBytes = await readConfigValue<number>("system.maxUploadBytes", 10 * 1024 * 1024);
-  if (fileStat.size > maxBytes) {
-    return NextResponse.json(
-      { error: `File exceeds max size (${maxBytes} bytes)` },
-      { status: 413 }
-    );
-  }
-
-  // Check file extension against whitelist
-  const ext = path.extname(filePath).slice(1).toLowerCase();
-  const allowedTypes = await readConfigValue<string[]>(
-    "hooks.autoUploadTypes",
-    DEFAULT_UPLOAD_TYPES
-  );
-  if (!allowedTypes.includes(ext)) {
-    return NextResponse.json(
-      { error: `File type .${ext} not in allowed list` },
-      { status: 400 }
-    );
-  }
-
-  // Look up task to get projectId and project localPath for path containment check
-  const task = await db.task.findUnique({
-    where: { id: taskId },
-    select: {
-      projectId: true,
-      project: { select: { localPath: true } },
-    },
-  });
-  if (!task) {
-    return NextResponse.json({ error: "Task not found" }, { status: 404 });
-  }
-
-  // SECURITY: Restrict filePath to within the project directory (or /tmp)
-  // Prevents arbitrary file read from any path on the filesystem
-  const resolvedFile = path.resolve(filePath);
-  const projectRoot = task.project.localPath;
-  const tmpDir = process.env.TMPDIR || "/tmp";
-  const isUnderProject = projectRoot && resolvedFile.startsWith(path.resolve(projectRoot) + path.sep);
-  const isUnderTmp = resolvedFile.startsWith(path.resolve(tmpDir) + path.sep);
-  if (!isUnderProject && !isUnderTmp) {
-    return NextResponse.json(
-      { error: "filePath must be within the project directory or temp directory" },
-      { status: 403 }
-    );
-  }
-
-  const projectId = task.projectId;
-
-  // Ensure target directory exists
-  const assetsDir = ensureAssetsDir(projectId);
-
-  // Handle filename collision
-  let filename = path.basename(filePath);
-  let destPath = path.join(assetsDir, filename);
-
-  if (existsSync(destPath)) {
-    const stem = path.basename(filename, path.extname(filename));
-    const timestamp = Date.now();
-    filename = `${stem}-${timestamp}.${ext}`;
-    destPath = path.join(assetsDir, filename);
-  }
-
-  // Copy file
-  try {
-    await copyFile(filePath, destPath);
-  } catch (err) {
-    return NextResponse.json(
-      { error: `Failed to copy file: ${err instanceof Error ? err.message : "unknown"}` },
-      { status: 500 }
-    );
-  }
-
-  // Create DB record
-  const mimeType = MIME_MAP[ext] || "application/octet-stream";
-  const asset = await db.projectAsset.create({
-    data: {
-      filename,
-      path: destPath,
-      mimeType,
-      size: fileStat.size,
-      projectId,
-      taskId,
-    },
-  });
-
-  return NextResponse.json({ success: true, assetId: asset.id });
-}

package/src/app/api/internal/notifications/pending/route.ts

@@ -1,20 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { requireLocalhost } from "@/lib/internal-api-guard";
-import type { TaskCompletionPayload } from "@/actions/onboarding-actions";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-// D-04: globalThis singleton — survives HMR/module re-evaluation in Next.js dev mode.
-const g = globalThis as typeof globalThis & {
-  __taskCompletionQueue?: TaskCompletionPayload[];
-};
-
-export async function GET(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const events = g.__taskCompletionQueue ?? [];
-  g.__taskCompletionQueue = [];
-  return NextResponse.json({ events });
-}

package/src/app/api/internal/terminal/[taskId]/buffer/route.ts

@@ -1,48 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { z } from "zod";
-import { getSession } from "@/lib/pty/session-store";
-import { requireLocalhost, validateTaskId } from "@/lib/internal-api-guard";
-
-// Prevent response caching — output changes on every call
-export const dynamic = "force-dynamic";
-// Require Node.js runtime — node-pty sessions only exist in Node.js process
-export const runtime = "nodejs";
-
-const linesSchema = z.coerce.number().int().min(1).max(500).default(100);
-
-export async function GET(
-  request: NextRequest,
-  { params }: { params: Promise<{ taskId: string }> }
-) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const { taskId } = await params;
-
-  const invalid = validateTaskId(taskId);
-  if (invalid) return invalid;
-
-  const session = getSession(taskId);
-  if (!session) {
-    return NextResponse.json(
-      { error: "No active session" },
-      { status: 404 }
-    );
-  }
-
-  // Parse optional ?lines= query param
-  const linesParam = request.nextUrl.searchParams.get("lines");
-  const parseResult = linesSchema.safeParse(linesParam ?? undefined);
-  const lineCount = parseResult.success ? parseResult.data : 100;
-
-  const buffer = session.getBuffer();
-  const allLines = buffer.split("\n");
-  const lines = allLines.slice(-lineCount);
-
-  return NextResponse.json({
-    taskId,
-    lines,
-    total: lines.length,
-    killed: session.killed,
-  });
-}

package/src/app/api/internal/terminal/[taskId]/input/route.ts

@@ -1,64 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { z } from "zod";
-import { getSession } from "@/lib/pty/session-store";
-import { requireLocalhost, validateTaskId } from "@/lib/internal-api-guard";
-
-// Prevent response caching
-export const dynamic = "force-dynamic";
-// Require Node.js runtime — node-pty sessions only exist in Node.js process
-export const runtime = "nodejs";
-
-const bodySchema = z.object({
-  text: z.string().min(1).max(10000),
-});
-
-export async function POST(
-  request: NextRequest,
-  { params }: { params: Promise<{ taskId: string }> }
-) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const { taskId } = await params;
-
-  const invalid = validateTaskId(taskId);
-  if (invalid) return invalid;
-
-  // Parse and validate request body
-  let parsed;
-  try {
-    const body = await request.json();
-    parsed = bodySchema.safeParse(body);
-  } catch {
-    return NextResponse.json(
-      { error: "Invalid body: text field required (string, 1-10000 chars)" },
-      { status: 400 }
-    );
-  }
-
-  if (!parsed.success) {
-    return NextResponse.json(
-      { error: "Invalid body: text field required (string, 1-10000 chars)" },
-      { status: 400 }
-    );
-  }
-
-  const session = getSession(taskId);
-  if (!session) {
-    return NextResponse.json(
-      { error: "No active session" },
-      { status: 404 }
-    );
-  }
-
-  if (session.killed) {
-    return NextResponse.json(
-      { error: "Session has exited" },
-      { status: 410 }
-    );
-  }
-
-  session.write(parsed.data.text);
-
-  return NextResponse.json({ ok: true, taskId });
-}

package/src/app/api/internal/terminal/[taskId]/start/route.ts

@@ -1,37 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { z } from "zod";
-import { requireLocalhost, validateTaskId } from "@/lib/internal-api-guard";
-import { startPtyExecution } from "@/actions/agent-actions";
-
-export const dynamic = "force-dynamic";
-export const runtime = "nodejs";
-
-const bodySchema = z.object({
-  prompt: z.string().optional().default(""),
-});
-
-export async function POST(
-  request: NextRequest,
-  { params }: { params: Promise<{ taskId: string }> }
-) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const { taskId } = await params;
-  const idError = validateTaskId(taskId);
-  if (idError) return idError;
-
-  try {
-    const body = await request.json();
-    const parsed = bodySchema.safeParse(body);
-    if (!parsed.success) {
-      return NextResponse.json({ error: "Invalid body" }, { status: 400 });
-    }
-
-    const result = await startPtyExecution(taskId, parsed.data.prompt);
-    return NextResponse.json(result);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}

package/src/app/api/tasks/[taskId]/diff/route.ts

@@ -1,224 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { z } from "zod";
-import { db } from "@/lib/db";
-import { execFileSync } from "child_process";
-import { existsSync, readFileSync } from "fs";
-import path from "path";
-import { parseDiffOutput, checkConflicts, type DiffFile } from "@/lib/diff-parser";
-
-export async function GET(
-  _request: NextRequest,
-  { params }: { params: Promise<{ taskId: string }> }
-) {
-  const { taskId } = await params;
-
-  const parsed = z.string().cuid().safeParse(taskId);
-  if (!parsed.success) {
-    return NextResponse.json({ error: "Invalid task ID" }, { status: 400 });
-  }
-
-  try {
-    const task = await db.task.findUnique({
-      where: { id: parsed.data },
-      include: { project: true },
-    });
-
-    if (!task) {
-      return NextResponse.json({ error: "Task not found" }, { status: 404 });
-    }
-    if (!task.project?.localPath) {
-      return NextResponse.json(
-        { error: "Project has no local path" },
-        { status: 400 }
-      );
-    }
-
-    const baseBranch = task.baseBranch || "main";
-    const localPath = task.project.localPath;
-
-    const latestExecution = await db.taskExecution.findFirst({
-      where: { taskId: parsed.data },
-      orderBy: { createdAt: "desc" },
-    });
-
-    if (!latestExecution) {
-      return NextResponse.json({
-        files: [], totalAdded: 0, totalRemoved: 0,
-        hasConflicts: false, conflictFiles: [], commitCount: 0,
-      });
-    }
-
-    const forkCommit = latestExecution.forkCommit;
-    const mergeCommit = latestExecution.mergeCommit;
-    const branchTipCommit = latestExecution.branchTipCommit;
-    const worktreeBranch = latestExecution.worktreeBranch;
-    const worktreePath = latestExecution.worktreePath;
-
-    let diffCwd: string;
-    let diffTarget: string;
-
-    if (mergeCommit && forkCommit) {
-      // DONE state — use branchTipCommit to show only task's own changes,
-      // falling back to mergeCommit for backward compatibility
-      diffCwd = localPath;
-      const endCommit = branchTipCommit || mergeCommit;
-      diffTarget = `${forkCommit}..${endCommit}`;
-    } else if (forkCommit && worktreePath && existsSync(worktreePath)) {
-      // IN_PROGRESS/IN_REVIEW worktree mode — diff from fork point in worktree (includes uncommitted)
-      diffCwd = worktreePath;
-      diffTarget = forkCommit;
-    } else if (forkCommit && !worktreePath) {
-      // IN_PROGRESS/IN_REVIEW direct mode — diff from fork point on main repo
-      diffCwd = localPath;
-      diffTarget = forkCommit;
-    } else if (worktreeBranch) {
-      // Fallback — use branch names to compute merge-base
-      try {
-        const mb = execFileSync(
-          "git", ["merge-base", baseBranch, worktreeBranch],
-          { cwd: localPath, encoding: "utf-8", timeout: 5000 }
-        ).trim();
-        const wtp = worktreePath && existsSync(worktreePath) ? worktreePath : localPath;
-        diffCwd = wtp;
-        diffTarget = mb;
-      } catch {
-        return NextResponse.json({
-          error: "Branch deleted", branchDeleted: true,
-          files: [], totalAdded: 0, totalRemoved: 0,
-          hasConflicts: false, conflictFiles: [], commitCount: 0,
-        });
-      }
-    } else {
-      return NextResponse.json({
-        files: [], totalAdded: 0, totalRemoved: 0,
-        hasConflicts: false, conflictFiles: [], commitCount: 0,
-      });
-    }
-
-    // Run numstat + unified diff
-    const numstat = execFileSync(
-      "git", ["diff", "--numstat", diffTarget],
-      { cwd: diffCwd, encoding: "utf-8", timeout: 30000 }
-    );
-    const unified = execFileSync(
-      "git", ["diff", "--unified=3", diffTarget],
-      { cwd: diffCwd, encoding: "utf-8", timeout: 30000 }
-    );
-
-    const parsedDiff = parseDiffOutput(numstat, unified);
-
-    // Include untracked files for live worktree diffs (not DONE state)
-    if (!mergeCommit && worktreePath && existsSync(worktreePath)) {
-      try {
-        const untrackedOutput = execFileSync(
-          "git", ["ls-files", "--others", "--exclude-standard"],
-          { cwd: diffCwd, encoding: "utf-8", timeout: 5000 }
-        ).trim();
-        if (untrackedOutput) {
-          for (const filename of untrackedOutput.split("\n")) {
-            if (!filename) continue;
-            try {
-              const filePath = path.join(diffCwd, filename);
-              const content = readFileSync(filePath, "utf-8");
-              const lines = content.split("\n");
-              // Remove trailing empty line from split
-              if (lines[lines.length - 1] === "") lines.pop();
-              const lineCount = lines.length;
-              const patchLines = [
-                `diff --git a/${filename} b/${filename}`,
-                "new file mode 100644",
-                "--- /dev/null",
-                `+++ b/${filename}`,
-                `@@ -0,0 +1,${lineCount} @@`,
-                ...lines.map((l) => `+${l}`),
-              ];
-              const entry: DiffFile = {
-                filename,
-                added: lineCount,
-                removed: 0,
-                isBinary: false,
-                patch: patchLines.join("\n"),
-              };
-              parsedDiff.files.push(entry);
-              parsedDiff.totalAdded += lineCount;
-            } catch {
-              // Skip binary or unreadable files
-            }
-          }
-        }
-      } catch {
-        // ignore — best effort
-      }
-    }
-
-    // Conflict check only relevant before merge
-    let hasConflicts = false;
-    let conflictFiles: string[] = [];
-    if (!mergeCommit && worktreeBranch) {
-      ({ hasConflicts, conflictFiles } = checkConflicts(localPath, baseBranch, worktreeBranch));
-    }
-
-    // Commit count
-    let commitCount = 0;
-    if (mergeCommit && forkCommit) {
-      try {
-        const endCommit = branchTipCommit || mergeCommit;
-        const str = execFileSync(
-          "git", ["rev-list", "--count", `${forkCommit}..${endCommit}`],
-          { cwd: diffCwd, encoding: "utf-8", timeout: 5000 }
-        ).trim();
-        commitCount = parseInt(str, 10) || 0;
-      } catch {
-        // ignore
-      }
-    } else if (forkCommit) {
-      try {
-        const str = execFileSync(
-          "git", ["rev-list", "--count", `${forkCommit}..HEAD`],
-          { cwd: diffCwd, encoding: "utf-8", timeout: 5000 }
-        ).trim();
-        commitCount = parseInt(str, 10) || 0;
-      } catch {
-        // ignore
-      }
-    } else if (worktreeBranch) {
-      try {
-        const commitCountStr = execFileSync(
-          "git", ["rev-list", "--count", `${diffTarget}..${worktreeBranch}`],
-          { cwd: localPath, encoding: "utf-8", timeout: 5000 }
-        ).trim();
-        commitCount = parseInt(commitCountStr, 10) || 0;
-      } catch {
-        // ignore
-      }
-    }
-
-    // Check for uncommitted changes in worktree
-    let hasUncommitted = false;
-    if (worktreePath && existsSync(worktreePath) && !mergeCommit) {
-      try {
-        const status = execFileSync(
-          "git", ["status", "--porcelain"],
-          { cwd: worktreePath, encoding: "utf-8", timeout: 5000 }
-        ).trim();
-        hasUncommitted = status.length > 0;
-      } catch {
-        // ignore
-      }
-    }
-
-    return NextResponse.json({
-      ...parsedDiff,
-      hasConflicts,
-      conflictFiles,
-      commitCount,
-      hasUncommitted,
-    });
-  } catch (error) {
-    console.error("[diff] Failed to generate diff:", error);
-    return NextResponse.json(
-      { error: "Failed to generate diff" },
-      { status: 500 }
-    );
-  }
-}