vibora 4.5.2 → 4.7.0

package/server/index.js

@@ -14380,6 +14380,11 @@ function migrateSettings(parsed) {
   return result;
 }
 function expandPath(p) {
+  if (!p)
+    return p;
+  if (p === "~") {
+    return os.homedir();
+  }
   if (p.startsWith("~/")) {
     return path.join(os.homedir(), p.slice(2));
   }
@@ -146030,6 +146035,92 @@ app3.post("/sync-parent", async (c) => {
     return c.json({ error: err instanceof Error ? err.message : "Failed to sync parent" }, 500);
   }
 });
+app3.post("/create-pr", async (c) => {
+  try {
+    const body = await c.req.json();
+    const { worktreePath, title, baseBranch } = body;
+    if (!worktreePath || !title) {
+      return c.json({ error: "Missing required fields: worktreePath, title" }, 400);
+    }
+    if (!fs4.existsSync(worktreePath)) {
+      return c.json({ error: "Worktree path does not exist" }, 404);
+    }
+    try {
+      const status = gitExec(worktreePath, "status --porcelain");
+      if (status.trim()) {
+        return c.json({
+          error: "Worktree has uncommitted changes. Please commit changes before creating a PR.",
+          hasUncommittedChanges: true
+        }, 409);
+      }
+    } catch {}
+    let branch;
+    try {
+      branch = gitExec(worktreePath, "rev-parse --abbrev-ref HEAD");
+    } catch {
+      return c.json({ error: "Failed to determine current branch" }, 500);
+    }
+    const args = ["gh", "pr", "create", "--title", JSON.stringify(title), "--fill"];
+    if (baseBranch) {
+      args.push("--base", baseBranch);
+    }
+    try {
+      const output = execSync3(args.join(" "), {
+        cwd: worktreePath,
+        encoding: "utf-8",
+        timeout: 30000,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      const prUrl = output.trim();
+      return c.json({
+        success: true,
+        prUrl,
+        branch
+      });
+    } catch (err) {
+      const errorMsg = err instanceof Error ? err.message : "Unknown error";
+      const stderr = err && typeof err === "object" && "stderr" in err ? String(err.stderr).trim() : "";
+      if (stderr.includes("already exists") || errorMsg.includes("already exists")) {
+        try {
+          const prViewOutput = execSync3("gh pr view --json url -q .url", {
+            cwd: worktreePath,
+            encoding: "utf-8",
+            timeout: 1e4,
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+          const existingPrUrl = prViewOutput.trim();
+          return c.json({
+            error: "A pull request already exists for this branch",
+            prAlreadyExists: true,
+            existingPrUrl
+          }, 409);
+        } catch {
+          return c.json({
+            error: "A pull request already exists for this branch",
+            prAlreadyExists: true
+          }, 409);
+        }
+      }
+      if (stderr.includes("not pushed") || errorMsg.includes("not pushed") || stderr.includes("no upstream") || errorMsg.includes("no upstream")) {
+        return c.json({
+          error: "Branch has not been pushed to remote. Please push first.",
+          branchNotPushed: true
+        }, 409);
+      }
+      if (stderr.includes("gh auth login") || errorMsg.includes("gh auth login")) {
+        return c.json({
+          error: "GitHub CLI not authenticated. Run `gh auth login` first.",
+          notAuthenticated: true
+        }, 401);
+      }
+      return c.json({
+        error: stderr || errorMsg || "Failed to create PR"
+      }, 500);
+    }
+  } catch (err) {
+    return c.json({ error: err instanceof Error ? err.message : "Failed to create PR" }, 500);
+  }
+});
 app3.get("/remote", (c) => {
   let repoPath = c.req.query("path");
   if (!repoPath) {
@@ -147297,9 +147388,10 @@ app8.patch("/", async (c) => {
 var terminal_view_state_default = app8;
 
 // server/routes/repositories.ts
-import { existsSync as existsSync10, rmSync as rmSync4, readdirSync as readdirSync7 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync10, rmSync as rmSync4, readdirSync as readdirSync7, mkdirSync as mkdirSync6 } from "fs";
+import { join as join12, resolve as resolve4 } from "path";
 import { execSync as execSync4 } from "child_process";
+import { homedir as homedir5 } from "os";
 
 // server/lib/git-utils.ts
 function isGitUrl(source) {
@@ -147343,15 +147435,16 @@ app9.post("/", async (c) => {
     if (!body.path) {
       return c.json({ error: "path is required" }, 400);
     }
-    const existing = db.select().from(repositories).where(eq(repositories.path, body.path)).get();
+    const repoPath = expandPath(body.path);
+    const existing = db.select().from(repositories).where(eq(repositories.path, repoPath)).get();
     if (existing) {
       return c.json({ error: "Repository with this path already exists" }, 400);
     }
     const now = new Date().toISOString();
-    const displayName = body.displayName || body.path.split("/").pop() || "repo";
+    const displayName = body.displayName || repoPath.split("/").pop() || "repo";
     const newRepo = {
       id: crypto.randomUUID(),
-      path: body.path,
+      path: repoPath,
       displayName,
       startupScript: body.startupScript || null,
       copyFiles: body.copyFiles || null,
@@ -147376,12 +147469,37 @@ app9.post("/clone", async (c) => {
       return c.json({ error: "Invalid git URL format" }, 400);
     }
     const settings = getSettings();
-    const gitReposDir = settings.paths.defaultGitReposDir;
-    const repoName = extractRepoNameFromUrl(body.url);
-    const targetPath = join12(gitReposDir, repoName);
+    let parentDir = body.targetDir?.trim() || settings.paths.defaultGitReposDir;
+    parentDir = expandPath(parentDir);
+    const home = homedir5();
+    if (resolve4(parentDir) === home) {
+      return c.json({ error: "Cannot clone directly into home directory. Please specify a subdirectory." }, 400);
+    }
+    const repoName = body.folderName?.trim() || extractRepoNameFromUrl(body.url);
+    if (!repoName) {
+      return c.json({ error: "Could not determine folder name from URL" }, 400);
+    }
+    if (repoName === "." || repoName === "..") {
+      return c.json({ error: "Invalid folder name" }, 400);
+    }
+    if (repoName.includes("/") || repoName.includes("\\")) {
+      return c.json({ error: "Folder name cannot contain path separators" }, 400);
+    }
+    const targetPath = join12(parentDir, repoName);
+    const resolvedParent = resolve4(parentDir);
+    const resolvedTarget = resolve4(targetPath);
+    if (!resolvedTarget.startsWith(resolvedParent + "/") && resolvedTarget !== resolvedParent) {
+      return c.json({ error: "Invalid target path" }, 400);
+    }
     if (existsSync10(targetPath)) {
       return c.json({ error: `Directory already exists: ${targetPath}` }, 400);
     }
+    if (!existsSync10(parentDir)) {
+      if (resolve4(parentDir) === home) {
+        return c.json({ error: "Cannot create home directory" }, 400);
+      }
+      mkdirSync6(parentDir, { recursive: true });
+    }
     try {
       execSync4(`git clone "${body.url}" "${targetPath}"`, {
         encoding: "utf-8",
@@ -147389,7 +147507,7 @@ app9.post("/clone", async (c) => {
         timeout: 120000
       });
     } catch (cloneErr) {
-      if (existsSync10(targetPath)) {
+      if (existsSync10(targetPath) && resolvedTarget.startsWith(resolvedParent + "/")) {
         rmSync4(targetPath, { recursive: true, force: true });
       }
       const errorMessage = cloneErr instanceof Error ? cloneErr.message : "Clone failed";
@@ -147449,18 +147567,43 @@ app9.patch("/:id", async (c) => {
 });
 app9.delete("/:id", (c) => {
   const id = c.req.param("id");
+  const deleteDirectory = c.req.query("deleteDirectory") === "true";
   const existing = db.select().from(repositories).where(eq(repositories.id, id)).get();
   if (!existing) {
     return c.json({ error: "Repository not found" }, 404);
   }
+  if (deleteDirectory && existing.path) {
+    const repoPath = existing.path;
+    const home = homedir5();
+    if (resolve4(repoPath) === home) {
+      return c.json({ error: "Cannot delete home directory" }, 400);
+    }
+    const dangerousPaths = ["/", "/home", "/usr", "/etc", "/var", "/tmp", "/root"];
+    if (dangerousPaths.includes(resolve4(repoPath))) {
+      return c.json({ error: "Cannot delete system directory" }, 400);
+    }
+    if (existsSync10(repoPath)) {
+      const gitPath = join12(repoPath, ".git");
+      if (!existsSync10(gitPath)) {
+        return c.json({ error: "Directory does not appear to be a git repository" }, 400);
+      }
+      try {
+        rmSync4(repoPath, { recursive: true, force: true });
+      } catch (err) {
+        return c.json({
+          error: `Failed to delete directory: ${err instanceof Error ? err.message : "Unknown error"}`
+        }, 500);
+      }
+    }
+  }
   db.delete(repositories).where(eq(repositories.id, id)).run();
-  return c.json({ success: true });
+  return c.json({ success: true, directoryDeleted: deleteDirectory });
 });
 app9.post("/scan", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
     const settings = getSettings();
-    const directory = body.directory || settings.paths.defaultGitReposDir;
+    const directory = expandPath(body.directory || settings.paths.defaultGitReposDir);
     if (!existsSync10(directory)) {
       return c.json({ error: `Directory does not exist: ${directory}` }, 400);
     }
@@ -151521,7 +151664,7 @@ var github_default = app12;
 // server/routes/monitoring.ts
 import { readdirSync as readdirSync8, readFileSync as readFileSync7, readlinkSync as readlinkSync2, existsSync as existsSync12 } from "fs";
 import { execSync as execSync7 } from "child_process";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 import { join as join14 } from "path";
 
 // server/services/metrics-collector.ts
@@ -152309,7 +152452,7 @@ monitoringRoutes.post("/vibora-instances/:pid/kill", async (c) => {
       killedPids.push(pid);
     } catch {}
   }
-  await new Promise((resolve4) => setTimeout(resolve4, 500));
+  await new Promise((resolve5) => setTimeout(resolve5, 500));
   for (const pid of pidsToKill) {
     try {
       process.kill(pid, 0);
@@ -152327,7 +152470,7 @@ var cachedUsage = null;
 var usageCacheTimestamp = 0;
 var USAGE_CACHE_MS = 15 * 1000;
 async function getClaudeOAuthToken() {
-  const primaryPath = join14(homedir5(), ".claude", ".credentials.json");
+  const primaryPath = join14(homedir6(), ".claude", ".credentials.json");
   try {
     if (existsSync12(primaryPath)) {
       const content = readFileSync7(primaryPath, "utf-8");
@@ -152493,6 +152636,212 @@ app13.get("/dependencies", (c) => {
 });
 var system_default = app13;
 
+// server/routes/exec.ts
+import { spawn as spawn3 } from "child_process";
+import { randomUUID } from "crypto";
+import * as os6 from "os";
+var DEFAULT_TIMEOUT = 30000;
+var START_MARKER = `<<VIBORA_CMD_START_${randomUUID().slice(0, 8)}>>`;
+var END_MARKER_PREFIX = `<<VIBORA_CMD_END_${randomUUID().slice(0, 8)}:`;
+var sessions = new Map;
+function createSession(cwd, name) {
+  const id = randomUUID();
+  const initialCwd = cwd || os6.homedir();
+  const proc2 = spawn3("/bin/bash", ["--norc", "--noprofile"], {
+    cwd: initialCwd,
+    env: { ...process.env, TERM: "dumb" },
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const session = {
+    id,
+    name,
+    process: proc2,
+    cwd: initialCwd,
+    outputBuffer: "",
+    stderrBuffer: "",
+    pendingResolve: null,
+    pendingReject: null,
+    createdAt: new Date,
+    lastUsedAt: new Date
+  };
+  proc2.stdout?.on("data", (data) => {
+    session.outputBuffer += data.toString();
+    checkForCompletion(session);
+  });
+  proc2.stderr?.on("data", (data) => {
+    session.stderrBuffer += data.toString();
+  });
+  proc2.on("error", (err) => {
+    if (session.pendingReject) {
+      session.pendingReject(err);
+      session.pendingResolve = null;
+      session.pendingReject = null;
+    }
+  });
+  proc2.on("exit", () => {
+    sessions.delete(id);
+    if (session.pendingReject) {
+      session.pendingReject(new Error("Shell process exited unexpectedly"));
+      session.pendingResolve = null;
+      session.pendingReject = null;
+    }
+  });
+  sessions.set(id, session);
+  return session;
+}
+function checkForCompletion(session) {
+  if (!session.pendingResolve)
+    return;
+  const endMarkerRegex = new RegExp(`${END_MARKER_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(\\d+)>>`);
+  const match3 = session.outputBuffer.match(endMarkerRegex);
+  if (match3) {
+    const exitCode = parseInt(match3[1], 10);
+    const startIdx = session.outputBuffer.indexOf(START_MARKER);
+    const endIdx = session.outputBuffer.indexOf(match3[0]);
+    let stdout = "";
+    if (startIdx !== -1 && endIdx > startIdx) {
+      stdout = session.outputBuffer.slice(startIdx + START_MARKER.length + 1, endIdx);
+      if (stdout.endsWith(`
+`)) {
+        stdout = stdout.slice(0, -1);
+      }
+    }
+    const stderr = session.stderrBuffer;
+    session.outputBuffer = "";
+    session.stderrBuffer = "";
+    const resolve5 = session.pendingResolve;
+    session.pendingResolve = null;
+    session.pendingReject = null;
+    resolve5({ stdout, stderr, exitCode });
+  }
+}
+function destroySession(id) {
+  const session = sessions.get(id);
+  if (!session)
+    return false;
+  try {
+    session.process.kill();
+  } catch {}
+  sessions.delete(id);
+  return true;
+}
+async function executeCommand(session, command, timeout) {
+  return new Promise((resolve5, reject) => {
+    session.lastUsedAt = new Date;
+    session.outputBuffer = "";
+    session.stderrBuffer = "";
+    session.pendingResolve = resolve5;
+    session.pendingReject = reject;
+    const wrappedCommand = `echo "${START_MARKER}"; ${command}; echo "${END_MARKER_PREFIX}$?>>"
+`;
+    const timeoutId = setTimeout(() => {
+      session.pendingResolve = null;
+      session.pendingReject = null;
+      reject(new Error("Command timed out"));
+    }, timeout);
+    const originalResolve = resolve5;
+    session.pendingResolve = (result) => {
+      clearTimeout(timeoutId);
+      originalResolve(result);
+    };
+    session.process.stdin?.write(wrappedCommand);
+  });
+}
+async function updateSessionCwd(session) {
+  try {
+    const result = await executeCommand(session, "pwd", 5000);
+    if (result.exitCode === 0 && result.stdout.trim()) {
+      session.cwd = result.stdout.trim();
+    }
+  } catch {}
+}
+var app14 = new Hono2;
+app14.post("/", async (c) => {
+  try {
+    const body = await c.req.json();
+    const { command, sessionId, cwd, timeout = DEFAULT_TIMEOUT, name } = body;
+    if (!command) {
+      return c.json({ error: "command is required" }, 400);
+    }
+    let session;
+    if (sessionId) {
+      const existing = sessions.get(sessionId);
+      if (!existing) {
+        return c.json({ error: `Session ${sessionId} not found` }, 404);
+      }
+      session = existing;
+    } else {
+      session = createSession(cwd, name);
+    }
+    try {
+      const result = await executeCommand(session, command, timeout);
+      await updateSessionCwd(session);
+      const response = {
+        sessionId: session.id,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        exitCode: result.exitCode,
+        timedOut: false
+      };
+      return c.json(response);
+    } catch (err) {
+      if (err instanceof Error && err.message === "Command timed out") {
+        const response = {
+          sessionId: session.id,
+          stdout: session.outputBuffer,
+          stderr: session.stderrBuffer,
+          exitCode: null,
+          timedOut: true
+        };
+        return c.json(response);
+      }
+      throw err;
+    }
+  } catch (err) {
+    return c.json({ error: err instanceof Error ? err.message : "Failed to execute command" }, 500);
+  }
+});
+app14.get("/sessions", (c) => {
+  const sessionList = [];
+  for (const [id, session] of sessions) {
+    sessionList.push({
+      id,
+      name: session.name,
+      cwd: session.cwd,
+      createdAt: session.createdAt.toISOString(),
+      lastUsedAt: session.lastUsedAt.toISOString()
+    });
+  }
+  return c.json(sessionList);
+});
+app14.patch("/sessions/:id", async (c) => {
+  const id = c.req.param("id");
+  const session = sessions.get(id);
+  if (!session) {
+    return c.json({ error: `Session ${id} not found` }, 404);
+  }
+  const body = await c.req.json();
+  if (body.name !== undefined) {
+    session.name = body.name;
+  }
+  return c.json({
+    id: session.id,
+    name: session.name,
+    cwd: session.cwd,
+    createdAt: session.createdAt.toISOString(),
+    lastUsedAt: session.lastUsedAt.toISOString()
+  });
+});
+app14.delete("/sessions/:id", (c) => {
+  const id = c.req.param("id");
+  const destroyed = destroySession(id);
+  if (!destroyed) {
+    return c.json({ error: `Session ${id} not found` }, 404);
+  }
+  return c.json({ success: true });
+});
+var exec_default = app14;
+
 // server/app.ts
 function getDistPath() {
   if (process.env.VIBORA_PACKAGE_ROOT) {
@@ -152501,35 +152850,36 @@ function getDistPath() {
   return join15(process.cwd(), "dist");
 }
 function createApp() {
-  const app14 = new Hono2;
-  app14.use("*", logger());
-  app14.use("*", cors({
+  const app15 = new Hono2;
+  app15.use("*", logger());
+  app15.use("*", cors({
     origin: "*",
     allowMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
     allowHeaders: ["Content-Type"]
   }));
-  app14.route("/health", health_default);
-  app14.route("/api/tasks", tasks_default);
-  app14.route("/api/git", git_default);
-  app14.route("/api/fs", filesystem_default);
-  app14.route("/api/config", config_default);
-  app14.route("/api/uploads", uploads_default);
-  app14.route("/api/worktrees", worktrees_default);
-  app14.route("/api/terminal-view-state", terminal_view_state_default);
-  app14.route("/api/repositories", repositories_default);
-  app14.route("/api/copier", copier_default);
-  app14.route("/api/linear", linear_default);
-  app14.route("/api/github", github_default);
-  app14.route("/api/monitoring", monitoringRoutes);
-  app14.route("/api/system", system_default);
-  app14.post("/api/logs", async (c) => {
+  app15.route("/health", health_default);
+  app15.route("/api/tasks", tasks_default);
+  app15.route("/api/git", git_default);
+  app15.route("/api/fs", filesystem_default);
+  app15.route("/api/config", config_default);
+  app15.route("/api/uploads", uploads_default);
+  app15.route("/api/worktrees", worktrees_default);
+  app15.route("/api/terminal-view-state", terminal_view_state_default);
+  app15.route("/api/repositories", repositories_default);
+  app15.route("/api/copier", copier_default);
+  app15.route("/api/linear", linear_default);
+  app15.route("/api/github", github_default);
+  app15.route("/api/monitoring", monitoringRoutes);
+  app15.route("/api/system", system_default);
+  app15.route("/api/exec", exec_default);
+  app15.post("/api/logs", async (c) => {
     const { entries } = await c.req.json();
     for (const entry of entries) {
       writeEntry(entry);
     }
     return c.json({ ok: true });
   });
-  app14.post("/api/debug", async (c) => {
+  app15.post("/api/debug", async (c) => {
     const body = await c.req.json();
     const entry = {
       ts: new Date().toISOString(),
@@ -152566,14 +152916,14 @@ function createApp() {
         headers: { "Content-Type": mimeTypes2[ext2 || ""] || "application/octet-stream" }
       });
     };
-    app14.get("/assets/*", async (c) => {
+    app15.get("/assets/*", async (c) => {
       const assetPath = join15(distPath, c.req.path);
       if (existsSync13(assetPath)) {
         return serveFile(assetPath);
       }
       return c.notFound();
     });
-    app14.get("/sounds/*", async (c) => {
+    app15.get("/sounds/*", async (c) => {
       const soundPath = join15(distPath, c.req.path);
       if (existsSync13(soundPath)) {
         return serveFile(soundPath);
@@ -152582,7 +152932,7 @@ function createApp() {
     });
     const staticFiles = ["vibora-icon.png", "vibora-logo.jpeg", "vite.svg", "logo-dark.jpg", "logo-light.jpg", "goat.jpeg"];
     for (const file of staticFiles) {
-      app14.get(`/${file}`, async () => {
+      app15.get(`/${file}`, async () => {
         const filePath = join15(distPath, file);
         if (existsSync13(filePath)) {
           return serveFile(filePath);
@@ -152590,7 +152940,7 @@ function createApp() {
         return new Response("Not Found", { status: 404 });
       });
     }
-    app14.get("*", async (c, next) => {
+    app15.get("*", async (c, next) => {
       const path9 = c.req.path;
       if (path9.startsWith("/api/") || path9.startsWith("/ws/") || path9 === "/health") {
         return next();
@@ -152599,7 +152949,7 @@ function createApp() {
       return c.html(html);
     });
   }
-  return app14;
+  return app15;
 }
 
 // server/services/pr-monitor.ts
@@ -152666,11 +153016,11 @@ function stopPRMonitor() {
 var PORT = getSettingByKey("port");
 var HOST = process.env.HOST || "localhost";
 async function checkPortAvailable(port, host) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const server = createServer();
-    server.once("error", () => resolve4(false));
+    server.once("error", () => resolve5(false));
     server.once("listening", () => {
-      server.close(() => resolve4(true));
+      server.close(() => resolve5(true));
     });
     server.listen(port, host);
   });
@@ -152702,11 +153052,11 @@ setBroadcastDestroyed((terminalId) => {
     payload: { terminalId }
   });
 });
-var app14 = createApp();
-var { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app: app14 });
-app14.get("/ws/terminal", upgradeWebSocket(() => terminalWebSocketHandlers));
+var app15 = createApp();
+var { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app: app15 });
+app15.get("/ws/terminal", upgradeWebSocket(() => terminalWebSocketHandlers));
 var server = serve({
-  fetch: app14.fetch,
+  fetch: app15.fetch,
   port: PORT,
   hostname: HOST
 }, (info) => {