tower-studio 0.1.3 → 0.1.6

package/src/lib/i18n.tsx

@@ -1,64 +0,0 @@
-"use client";
-
-import { createContext, useContext, useState, useCallback, useEffect, type ReactNode } from "react";
-import { zh } from "./i18n/zh";
-import { en } from "./i18n/en";
-export type { TranslationKey } from "./i18n/types";
-
-export type Locale = "zh" | "en";
-
-const translations = { zh, en };
-
-type TranslationKey = keyof typeof zh;
-
-interface I18nContextValue {
-  locale: Locale;
-  setLocale: (locale: Locale) => void;
-  t: (key: TranslationKey, vars?: Record<string, string>) => string;
-}
-
-const I18nContext = createContext<I18nContextValue | null>(null);
-
-export function I18nProvider({ children }: { children: ReactNode }) {
-  // Always start with "zh" on both server and client to avoid hydration mismatch.
-  // The real locale is read from localStorage in useEffect after mount.
-  const [locale, setLocaleState] = useState<Locale>("zh");
-
-  useEffect(() => {
-    const stored = localStorage.getItem("locale") as Locale | null;
-    if (stored && stored !== locale) {
-      setLocaleState(stored);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  const setLocale = useCallback((l: Locale) => {
-    setLocaleState(l);
-    localStorage.setItem("locale", l);
-  }, []);
-
-  const t = useCallback(
-    (key: TranslationKey, vars?: Record<string, string>) => {
-      let str = translations[locale][key] ?? key;
-      if (vars) {
-        for (const [k, v] of Object.entries(vars)) {
-          str = str.replace(`{${k}}`, v);
-        }
-      }
-      return str;
-    },
-    [locale]
-  );
-
-  return (
-    <I18nContext.Provider value={{ locale, setLocale, t }}>
-      {children}
-    </I18nContext.Provider>
-  );
-}
-
-export function useI18n() {
-  const ctx = useContext(I18nContext);
-  if (!ctx) throw new Error("useI18n must be used within I18nProvider");
-  return ctx;
-}

package/src/lib/init-tower.ts

@@ -1,129 +0,0 @@
-/**
- * Ensure .tower/ directory exists with assistant persona and skill files.
- * Called once on server startup via instrumentation.ts.
- * Idempotent — skips files that already exist.
- */
-
-import { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-import { homedir } from "os";
-import { getAssistantDir } from "./tower-dir";
-
-const CLAUDE_MD_CONTENT = `# Tower Assistant
-
-你是 Tower Assistant — Tower 任务管理平台的内置 AI 操作员。
-
-## 身份
-
-- 你是一个**任务管理操作员**，不是编程助手
-- 你通过 Tower MCP 工具帮助用户管理工作区、项目、任务
-- 你**不能**读写文件、运行命令、编辑代码、搜索网页
-- 如果用户请求你无法完成的操作，告诉他们需要通过开发 MCP 扩展来支持
-
-## 回复风格
-
-- 使用用户的语言回复（中文问中文答，英文问英文答）
-- 简洁明了，不要冗长的解释
-- 主动使用工具查询信息，而不是猜测
-- 当用户问"你能做什么"时，只列出 Tower MCP 工具提供的能力
-`;
-
-export function ensureTowerDir(): string {
-  const assistantDir = getAssistantDir();
-  const claudeMd = join(assistantDir, "CLAUDE.md");
-  const root = process.cwd();
-  const skillSrc = join(root, "skills", "tower", "SKILL.md");
-  const skillDestDir = join(assistantDir, ".claude", "skills", "tower");
-  const skillDest = join(skillDestDir, "SKILL.md");
-
-  // 2. Ensure CLAUDE.md exists
-  if (!existsSync(claudeMd)) {
-    writeFileSync(claudeMd, CLAUDE_MD_CONTENT, "utf-8");
-    console.error(`[init-tower] Created ${claudeMd}`);
-  }
-
-  // 3. Copy SKILL.md from source if missing
-  if (existsSync(skillSrc) && !existsSync(skillDest)) {
-    mkdirSync(skillDestDir, { recursive: true });
-    copyFileSync(skillSrc, skillDest);
-    console.error(`[init-tower] Copied SKILL.md → ${skillDestDir}`);
-  }
-
-  // 4. Auto-install Claude Code hooks (SessionStart + PostToolUse)
-  ensureClaudeHooks();
-
-  return assistantDir;
-}
-
-/**
- * Ensure Tower hooks are registered in ~/.claude/settings.json.
- * Idempotent — skips if hooks already present.
- */
-function ensureClaudeHooks(): void {
-  const settingsPath = join(homedir(), ".claude", "settings.json");
-  // Use forward slashes for cross-platform compatibility in hook commands
-  const root = process.cwd().replace(/\\/g, "/");
-
-  let settings: Record<string, unknown> = {};
-  try {
-    settings = JSON.parse(readFileSync(settingsPath, "utf-8"));
-  } catch {
-    // File doesn't exist or invalid JSON — start fresh
-  }
-
-  const hooks = (settings["hooks"] as Record<string, unknown>) ?? {};
-  let changed = false;
-
-  // SessionStart hook — reports sessionId
-  const sessionStartEntries = (hooks["SessionStart"] as Array<{ hooks: Array<{ command: string }> }>) ?? [];
-  const hasSessionStart = sessionStartEntries.some(
-    (e) => e.hooks?.some((h) => h.command?.includes("session-start-hook.js"))
-  );
-  if (!hasSessionStart) {
-    const hookPath = join(root, "scripts", "session-start-hook.js").replace(/\\/g, "/");
-    sessionStartEntries.push({
-      hooks: [{ command: `node "${hookPath}"`, timeout: 5, type: "command" } as never],
-    });
-    hooks["SessionStart"] = sessionStartEntries;
-    changed = true;
-    console.error("[init-tower] Installed SessionStart hook");
-  }
-
-  // PostToolUse hook — auto-uploads files
-  const postToolEntries = (hooks["PostToolUse"] as Array<{ hooks: Array<{ command: string }> }>) ?? [];
-  const hasPostTool = postToolEntries.some(
-    (e) => e.hooks?.some((h) => h.command?.includes("post-tool-hook.js"))
-  );
-  if (!hasPostTool) {
-    const hookPath = join(root, "scripts", "post-tool-hook.js").replace(/\\/g, "/");
-    postToolEntries.push({
-      hooks: [{ command: `node "${hookPath}"`, timeout: 10, type: "command" } as never],
-      matcher: "Write|Edit|MultiEdit",
-    } as never);
-    hooks["PostToolUse"] = postToolEntries;
-    changed = true;
-    console.error("[init-tower] Installed PostToolUse hook");
-  }
-
-  // Stop hook — notifies Tower when Claude finishes responding
-  const stopEntries = (hooks["Stop"] as Array<{ hooks: Array<{ command: string }> }>) ?? [];
-  const hasStop = stopEntries.some(
-    (e) => e.hooks?.some((h) => h.command?.includes("stop-hook.js"))
-  );
-  if (!hasStop) {
-    const hookPath = join(root, "scripts", "stop-hook.js").replace(/\\/g, "/");
-    stopEntries.push({
-      hooks: [{ command: `node "${hookPath}"`, timeout: 5, type: "command" } as never],
-    });
-    hooks["Stop"] = stopEntries;
-    changed = true;
-    console.error("[init-tower] Installed Stop hook");
-  }
-
-  if (changed) {
-    settings["hooks"] = hooks;
-    const dir = join(homedir(), ".claude");
-    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-    writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
-  }
-}

package/src/lib/instrumentation-tasks.ts

@@ -1,116 +0,0 @@
-import { execFileSync } from "child_process";
-import { initDb, db } from "@/lib/db";
-import { logger } from "@/lib/logger";
-
-const log = logger.create("instrumentation");
-
-/**
- * Mark stale RUNNING executions as FAILED at server startup.
- * These are orphaned from a previous server crash or restart.
- */
-export async function cleanupStaleExecutions() {
-  try {
-    await initDb();
-    const result = await db.taskExecution.updateMany({
-      where: { status: "RUNNING" },
-      data: { status: "FAILED", endedAt: new Date() },
-    });
-    if (result.count > 0) {
-      log.warn(`Cleaned up ${result.count} stale RUNNING execution(s)`);
-    }
-  } catch (error) {
-    log.error("Stale execution cleanup failed", error);
-  }
-}
-
-/**
- * Ensure the builtin "Tower" label exists.
- * Used for system workbench tasks (hidden from kanban board).
- */
-export async function ensureTowerLabel() {
-  try {
-    await initDb();
-    const { TOWER_LABEL_NAME, TOWER_LABEL_COLOR } = await import("@/lib/constants");
-    const existing = await db.label.findFirst({
-      where: { name: TOWER_LABEL_NAME, isBuiltin: true },
-    });
-    if (!existing) {
-      await db.label.create({
-        data: { name: TOWER_LABEL_NAME, color: TOWER_LABEL_COLOR, isBuiltin: true },
-      });
-      log.info("Created builtin Tower label");
-    }
-  } catch (error) {
-    log.error("Failed to ensure Tower label", error);
-  }
-}
-
-/**
- * Find or create the Tower system task for a project.
- * Uses label-based lookup (not title) to survive project renames.
- */
-export async function ensureTowerTask(projectId: string, projectName: string): Promise<string> {
-  const { TOWER_LABEL_NAME } = await import("@/lib/constants");
-
-  // Find by Tower label (rename-safe)
-  const existing = await db.task.findFirst({
-    where: {
-      projectId,
-      labels: { some: { label: { name: TOWER_LABEL_NAME, isBuiltin: true } } },
-    },
-    select: { id: true },
-  });
-  if (existing) return existing.id;
-
-  // Create with label
-  const towerLabel = await db.label.findFirst({
-    where: { name: TOWER_LABEL_NAME, isBuiltin: true },
-  });
-
-  const task = await db.task.create({
-    data: {
-      title: `${projectName}-Tower`,
-      description: `Project workbench for ${projectName}`,
-      projectId,
-      status: "TODO",
-      priority: "LOW",
-      order: 0,
-      ...(towerLabel ? { labels: { create: { labelId: towerLabel.id } } } : {}),
-    },
-    select: { id: true },
-  });
-  return task.id;
-}
-
-/**
- * Prune orphaned git worktrees for all GIT projects at server startup.
- * This file is ONLY imported via dynamic import inside instrumentation.ts
- * when NEXT_RUNTIME === "nodejs", so Node.js modules are safe to use.
- */
-export async function pruneOrphanedWorktrees() {
-  try {
-    await initDb();
-
-    const gitProjects = await db.project.findMany({
-      where: {
-        type: "GIT",
-        localPath: { not: null },
-      },
-      select: { id: true, localPath: true, name: true },
-    });
-
-    for (const project of gitProjects) {
-      try {
-        execFileSync("git", ["worktree", "prune"], {
-          cwd: project.localPath!,
-          encoding: "utf-8",
-          timeout: 10000,
-        });
-      } catch (error) {
-        log.error(`git worktree prune failed for "${project.name}"`, error, { localPath: project.localPath! });
-      }
-    }
-  } catch (error) {
-    log.error("Worktree prune startup task failed", error);
-  }
-}

package/src/lib/internal-api-guard.ts

@@ -1,63 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-
-const LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
-const LOOPBACK_IPS = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
-const CUID_RE = /^c[a-z0-9]{20,30}$/;
-
-/**
- * Localhost-only request guard for internal API routes.
- *
- * Returns a 403 NextResponse if the request is not from a loopback address.
- * Returns null if the request is from localhost (caller should proceed).
- *
- * Multi-layer detection:
- * 1. Reject if x-forwarded-for contains any non-loopback IP (proxy bypass prevention)
- * 2. Check `host` header — must start with `localhost`, `127.0.0.1`, or `[::1]`
- *
- * Note: This app is designed for local-only use on a developer machine.
- * If deployed behind a reverse proxy, add authentication middleware.
- */
-export function requireLocalhost(request: NextRequest): NextResponse | null {
-  // Layer 1: If x-forwarded-for is present, ALL IPs must be loopback.
-  // Check this FIRST — a proxy sets this header, and if any IP is non-local, reject.
-  const forwarded = request.headers.get("x-forwarded-for");
-  if (forwarded) {
-    const ips = forwarded.split(",").map((ip) => ip.trim());
-    const allLoopback = ips.every((ip) => LOOPBACK_IPS.has(ip));
-    if (!allLoopback) {
-      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
-    }
-  }
-
-  // Layer 2: Check host header — must be a loopback address
-  const host = request.headers.get("host") ?? "";
-  const isLocalhostHost = LOOPBACK_HOSTS.some((h) => host.startsWith(h));
-  if (!isLocalhostHost) {
-    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
-  }
-
-  return null;
-}
-
-/**
- * Validate that a taskId matches CUID format.
- * Returns a 400 NextResponse if invalid, null if valid.
- */
-export function validateTaskId(taskId: string): NextResponse | null {
-  if (!CUID_RE.test(taskId)) {
-    return NextResponse.json({ error: "Invalid taskId format" }, { status: 400 });
-  }
-  return null;
-}
-
-/**
- * Validate that a projectId matches CUID format.
- * Prevents path-traversal and injection attacks via malformed projectIds.
- * Returns a 400 NextResponse if invalid, null if valid.
- */
-export function validateProjectId(projectId: string): NextResponse | null {
-  if (!CUID_RE.test(projectId)) {
-    return NextResponse.json({ error: "Invalid projectId format" }, { status: 400 });
-  }
-  return null;
-}

package/src/lib/logger.ts

@@ -1,46 +0,0 @@
-type LogLevel = "info" | "warn" | "error";
-
-function formatMessage(level: LogLevel, context: string, message: string, meta?: Record<string, unknown>): string {
-  const timestamp = new Date().toISOString();
-  const base = `[${timestamp}] ${level.toUpperCase()} [${context}] ${message}`;
-  if (meta && Object.keys(meta).length > 0) {
-    return `${base} ${JSON.stringify(meta)}`;
-  }
-  return base;
-}
-
-function createLogger(context: string) {
-  return {
-    info(message: string, meta?: Record<string, unknown>) {
-      console.log(formatMessage("info", context, message, meta));
-    },
-    warn(message: string, meta?: Record<string, unknown>) {
-      console.warn(formatMessage("warn", context, message, meta));
-    },
-    error(message: string, error?: unknown, meta?: Record<string, unknown>) {
-      const errMeta = error instanceof Error
-        ? { ...meta, error: error.message, stack: error.stack }
-        : { ...meta, error: String(error) };
-      console.error(formatMessage("error", context, message, errMeta));
-    },
-  };
-}
-
-export const logger = {
-  /** Create a scoped logger for a module/component */
-  create: createLogger,
-
-  // Convenience top-level methods
-  info(message: string, meta?: Record<string, unknown>) {
-    console.log(formatMessage("info", "app", message, meta));
-  },
-  warn(message: string, meta?: Record<string, unknown>) {
-    console.warn(formatMessage("warn", "app", message, meta));
-  },
-  error(message: string, error?: unknown, meta?: Record<string, unknown>) {
-    const errMeta = error instanceof Error
-      ? { ...meta, error: error.message, stack: error.stack }
-      : { ...meta, error: String(error) };
-    console.error(formatMessage("error", "app", message, errMeta));
-  },
-};

package/src/lib/mime-magic.ts

@@ -1,67 +0,0 @@
-/**
- * Magic-byte MIME detection for image files.
- *
- * Validates file type by inspecting raw bytes — never trusts browser-supplied
- * Content-Type or file.type, which can be spoofed (e.g. SVG-as-PNG XSS).
- */
-
-interface MimeSignature {
-  mime: string;
-  check: (b: Buffer) => boolean;
-}
-
-const SIGNATURES: MimeSignature[] = [
-  {
-    mime: "image/jpeg",
-    check: (b) => b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff,
-  },
-  {
-    mime: "image/png",
-    check: (b) =>
-      b[0] === 0x89 &&
-      b[1] === 0x50 &&
-      b[2] === 0x4e &&
-      b[3] === 0x47,
-  },
-  {
-    mime: "image/gif",
-    check: (b) => b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46,
-  },
-  {
-    mime: "image/webp",
-    // RIFF at bytes 0-3, WEBP at bytes 8-11
-    check: (b) =>
-      b[0] === 0x52 &&
-      b[1] === 0x49 &&
-      b[2] === 0x46 &&
-      b[3] === 0x46 &&
-      b[8] === 0x57 &&
-      b[9] === 0x45 &&
-      b[10] === 0x42 &&
-      b[11] === 0x50,
-  },
-];
-
-/**
- * Detect image MIME type from buffer magic bytes.
- *
- * Returns null if:
- * - Buffer is shorter than 12 bytes (not enough to check WEBP signature)
- * - No known image signature matches
- */
-export function detectImageMime(buffer: Buffer): string | null {
-  if (buffer.length < 12) return null;
-
-  for (const sig of SIGNATURES) {
-    if (sig.check(buffer)) return sig.mime;
-  }
-  return null;
-}
-
-/** Maps detected MIME type to canonical file extension. */
-export const MIME_TO_EXT: Record<string, string> = {
-  "image/jpeg": ".jpg",
-  "image/png": ".png",
-  "image/gif": ".gif",
-  "image/webp": ".webp",
-};