wicked-crew 0.5.0 → 0.6.0

package/dist/api/open-path.js

@@ -0,0 +1,79 @@
+// POST /open (crew#273): open a file/folder with the OS default application, daemon-side.
+//
+// The studio is a browser SPA and cannot spawn a process, so the open MUST happen here — which is
+// exactly why the path is validated against known roots first (the run's workdir / extra write
+// roots, registered repo roots) and the opener is spawned with the path as a single argv element,
+// never through a shell string. There is no injection surface: `open`/`xdg-open`/`cmd /c start`
+// receive the path verbatim as one argument.
+import { spawn } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+/**
+ * Is `target` inside `root` (or `root` itself), after normalization? Traversal-safe: the check is
+ * on the RESOLVED relative path's first segment, so `/root/../evil` never passes, and a sibling
+ * whose name merely starts with dots (`/a/..hidden`) is not wrongly excluded.
+ */
+export function isInsideRoot(root, target) {
+    // Symlink-safe (Copilot, PR#279): containment is judged on REAL paths, or a
+    // `<root>/symlink-to-outside` opens a file the validation never looked at. A missing
+    // leaf resolves through its deepest EXISTING ancestor (never a bare lexical fallback:
+    // on macOS the tmpdir itself sits under the /var → /private/var symlink, and a lexical
+    // fallback on one side of the comparison would break containment for real children).
+    // Only ENOENT falls to the ancestor walk; any OTHER filesystem error (EACCES, ELOOP, …)
+    // fails CLOSED — an unresolvable-but-existing path must not be judged lexically (Copilot).
+    const real = (p) => {
+        const abs = resolve(p);
+        try {
+            return realpathSync(abs);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                return null;
+            const parent = dirname(abs);
+            if (parent === abs)
+                return abs;
+            const rp = real(parent);
+            return rp === null ? null : join(rp, basename(abs));
+        }
+    };
+    const realRoot = real(root);
+    const realTarget = real(target);
+    if (realRoot === null || realTarget === null)
+        return false;
+    const rel = relative(realRoot, realTarget);
+    if (rel === '')
+        return true; // the root itself
+    if (isAbsolute(rel))
+        return false; // different drive/tree entirely (win32)
+    return rel.split(sep)[0] !== '..';
+}
+/** The platform's opener invocation. Exported for tests; args are always a real argv array. */
+export function platformOpenCommand(target) {
+    switch (process.platform) {
+        case 'darwin':
+            return { cmd: 'open', args: [target] };
+        case 'win32':
+            // `start` is a cmd builtin; the empty string is start's window-title slot so the path is
+            // never mistaken for a title. Still an argv array — no shell string is ever composed.
+            return { cmd: 'cmd', args: ['/c', 'start', '', target] };
+        default:
+            return { cmd: 'xdg-open', args: [target] };
+    }
+}
+/**
+ * Spawn the platform opener, detached, and resolve on SPAWN success (the OS accepted the process —
+ * what the opener then does with the path is the desktop environment's business). Rejects when the
+ * opener binary itself cannot be spawned, which the route reports as 502.
+ */
+export function openWithSystemDefault(target) {
+    const { cmd, args } = platformOpenCommand(target);
+    return new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
+        child.once('error', rejectPromise);
+        child.once('spawn', () => {
+            child.unref();
+            resolvePromise();
+        });
+    });
+}
+//# sourceMappingURL=open-path.js.map

package/dist/api/open-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-path.js","sourceRoot":"","sources":["../../src/api/open-path.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,kGAAkG;AAClG,+FAA+F;AAC/F,kGAAkG;AAClG,gGAAgG;AAChG,6CAA6C;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,4EAA4E;IAC5E,qFAAqF;IACrF,sFAAsF;IACtF,uFAAuF;IACvF,qFAAqF;IACrF,wFAAwF;IACxF,2FAA2F;IAC3F,MAAM,IAAI,GAAG,CAAC,CAAS,EAAiB,EAAE;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAC;YAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAC/C,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,wCAAwC;IAC3E,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AACpC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,KAAK,OAAO;YACV,yFAAyF;YACzF,sFAAsF;YACtF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D;YACE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes.d.ts

@@ -1,11 +1,122 @@
 import type { FastifyInstance } from 'fastify';
+import { z } from 'zod';
 import { CoreAdapter } from '../core/adapter.js';
 import type { GateCache } from './gate-cache.js';
 import type { ElicitationCache } from './elicitation-cache.js';
+import { QeGateCache } from '../qe/gate-events.js';
+import { SeatHealthTracker } from './seat-health.js';
+import { type ProjectRoutesDeps } from '../projects/routes.js';
+import { InteractiveBridgePool } from '../interactive/bridge-pool.js';
+import { AuditLog } from './audit.js';
+import { type AuthMode } from './auth.js';
 export { API_PREFIX } from './api-prefix.js';
+/**
+ * The launch body. Every field but `problem` is optional, which is what made stripping dangerous:
+ * omitting one is a legitimate request that gets an engine default, so a MISSPELLED one was
+ * indistinguishable from an omitted one and the run went ahead on a configuration the caller never
+ * asked for (FINDING-031).
+ *
+ * The names differ from core's on purpose and this is the trap worth knowing about: core's
+ * `LaunchSpec` takes `clis` (an array) and `workflow`, this takes `clisJson` (a JSON *string*) and
+ * `workflow`, and the `/ws` `sessionStarted` frame reports the chosen workflow as `workflowId`. A
+ * caller who reads the event stream to learn the field names arrives at `workflowId`, which this
+ * schema does not accept — so `.strict()` is what turns that trip into a 400 instead of an
+ * unworkflowed run reported as `201`.
+ */
+export declare const LaunchSchema: z.ZodObject<{
+    problem: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    clisJson: z.ZodOptional<z.ZodString>;
+    entityMode: z.ZodOptional<z.ZodEnum<["shared", "isolated"]>>;
+    humanConfirm: z.ZodOptional<z.ZodString>;
+    repoRef: z.ZodOptional<z.ZodString>;
+    workflow: z.ZodOptional<z.ZodString>;
+    /** DES-PROJECT-001 §2.2 — file the run into a project; membership attaches atomically with
+     *  the launch record. Unknown/archived ⇒ the launch fails (never a silent unfiled run). */
+    projectId: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    problem: string;
+    projectId?: string | undefined;
+    sessionId?: string | undefined;
+    clisJson?: string | undefined;
+    entityMode?: "shared" | "isolated" | undefined;
+    humanConfirm?: string | undefined;
+    repoRef?: string | undefined;
+    workflow?: string | undefined;
+}, {
+    problem: string;
+    projectId?: string | undefined;
+    sessionId?: string | undefined;
+    clisJson?: string | undefined;
+    entityMode?: "shared" | "isolated" | undefined;
+    humanConfirm?: string | undefined;
+    repoRef?: string | undefined;
+    workflow?: string | undefined;
+}>;
+export declare const GateSchema: z.ZodObject<{
+    approve: z.ZodBoolean;
+    amend: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    approve: boolean;
+    amend?: string | undefined;
+}, {
+    approve: boolean;
+    amend?: string | undefined;
+}>;
+export declare const OpenTerminalSchema: z.ZodObject<{
+    cwd: z.ZodString;
+    cmd: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    cols: z.ZodNumber;
+    rows: z.ZodNumber;
+    governed: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    cwd: string;
+    cols: number;
+    rows: number;
+    cmd?: string[] | undefined;
+    governed?: boolean | undefined;
+}, {
+    cwd: string;
+    cols: number;
+    rows: number;
+    cmd?: string[] | undefined;
+    governed?: boolean | undefined;
+}>;
+/** `POST /open` (crew#273) — the studio Files tab's "open with the OS default app" body. */
+export declare const OpenPathSchema: z.ZodObject<{
+    path: z.ZodString;
+    runId: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    path: string;
+    runId?: string | undefined;
+}, {
+    path: string;
+    runId?: string | undefined;
+}>;
+/** The actor/audit deps (task #88) — threaded from `createServer`. */
+export interface SecurityDeps {
+    audit: AuditLog;
+    authMode: AuthMode;
+}
+/**
+ * Daemon-runtime deps the routes read but `createServer` owns: the seat-health fold (crew#274,
+ * fed by the daemon's single CoreEvent subscription) and the OS opener for `/open` (crew#273,
+ * injectable so tests never actually open anything).
+ */
+export interface RuntimeDeps {
+    seatHealth?: SeatHealthTracker;
+    openWithOs?: (target: string) => Promise<void>;
+    /** Seat sign-in presence probe (seat sign-in) — injectable so route tests never read the
+     *  developer's real dotfiles. Defaults to the file/env heuristic in seat-signin.ts. */
+    signedIn?: (seatKey: string, workerConfigRoot?: string) => boolean | null;
+    /** The wicked-interactive bridge pool behind `/projects/:id/interactive/*` (DES-MERGE-001
+     *  slice 1). Injectable so the integration suite proxies to a FAKE bridge instead of
+     *  spawning a real `npx wicked-interactive serve`. */
+    interactiveBridges?: InteractiveBridgePool;
+}
 /**
  * The daemon REST surface. Every endpoint is a thin wrapper over one adapter /
  * core-ts call (DES-STUDIO-001 §2). `session`/`phase` nouns are now `run`/`unit`.
  */
-export declare function registerRoutes(app: FastifyInstance, adapter: CoreAdapter, gateCache: GateCache, elicitationCache: ElicitationCache): void;
+export declare function registerRoutes(app: FastifyInstance, adapter: CoreAdapter, gateCache: GateCache, elicitationCache: ElicitationCache, qeGateEvents?: QeGateCache, projects?: ProjectRoutesDeps, security?: SecurityDeps, runtime?: RuntimeDeps): void;
 //# sourceMappingURL=routes.d.ts.map

package/dist/api/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAQ/C,OAAO,EAAwB,WAAW,EAAkD,MAAM,oBAAoB,CAAC;AAEvH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAO/D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA0I7C;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,GACjC,IAAI,CAuiCN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAwB,WAAW,EAAkD,MAAM,oBAAoB,CAAC;AAEvH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAMnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAItE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAyF7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;;;;;;;;;;;;;;;;;;;EAElF,CAAC;AAEZ,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAQZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAEZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;CAC5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CA86CN"}