8 Commits

Author	SHA1	Message	Date
Anso	a826cd398d	fix: allow chmod on protected stack files (#1772) ... * fix: allow chmod on protected stack files Identity protection still blocks delete, rename, and copy-onto-reserved-name for compose and .env at the stack root. Permission changes are ordinary edits and must succeed from the explorer. * fix: gate chmod on compose files during stack ops Chmod on compose filenames and .blueprint.json now follows the same stack-op lock as content writes and uploads. Document allowed blueprint chmod and that content saves reset mode bits.	2026-08-05 09:22:36 -04:00
Anso	17a8dc8a94	fix(blueprints): fail closed on marker ownership for apply and withdraw (#1694) ... * fix(blueprints): fail closed on marker ownership for apply and withdraw Require a matching .blueprint.json under the stack lock, persist required_blueprint_id on deletion intents, remove the legacy remote apply fallback, and protect the marker in the file explorer. * fix(blueprints): add CodeQL path barriers on ownership probes Use the canonical resolve-and-startsWith sanitizer inline at the marker and stack-directory fs sinks so js/path-injection clears. * fix(blueprints): block delete on failed withdraw and defer marker write Refuse Blueprint DELETE when pre-delete withdraw does not complete, and write .blueprint.json only after a successful deploy so failed applies cannot orphan stacks or claim an unapplied revision. * test(blueprints): align lock-order assert with deferred marker write Update the per-stack lock ordering expectations to compose, cleanup, deploy, then marker after the partial-apply fix. * fix(deps): bump postcss past GHSA-r28c-9q8g-f849 for npm audit Raise the Vitest/Vite transitive postcss to 8.5.23 so Backend CI audit --audit-level=high passes.	2026-07-24 15:57:18 -04:00
Anso	37e6e48b40	feat(files): copy & duplicate, bulk actions, disk-backed uploads, and an accessible file tree (#1409) ... * perf(files): spool uploads to disk instead of buffering in memory Switch the stack file-explorer upload from multer memoryStorage to diskStorage and stream the spooled temp file through the file-root gateway, so an upload is never held fully in RAM. Authorization and root resolution now run before multer spools, so an unauthorized or read-only-root request is rejected without writing a temp file, and the spool is removed on every exit path. The named-volume helper write verifies the written byte count, since cat cannot report a short write. * feat(files): copy and duplicate files in the explorer Add a copy capability to the stack file explorer: a same-folder Duplicate (auto-suffixed name) and a "Copy to..." destination picker, on both filesystem and named-volume roots. Copying is within-root, symlink-leaf-safe, blocks a directory copy into its own subtree, and refuses to create a protected name (compose/.env) at the stack root while still allowing a protected file to be duplicated under a new name. * feat(files): make the file tree keyboard accessible Bring the stack file explorer tree to the WCAG tree pattern: rows are treeitems carrying aria-level, aria-selected, and aria-expanded, with a single roving tabindex and full keyboard navigation (arrow keys, Home/End, Enter/Space) over a flattened visible-node list that stays in lockstep with the rendered rows. A polite live region announces the selected file. No visual change to the tree. * feat(files): bulk select, delete, move, and download files Add multi-select to the stack file explorer (checkboxes plus Shift and Ctrl/Cmd click over the visible order) driving three bulk actions: delete, move, and download as a streamed .tar.gz. All run within the active root on both filesystem and named-volume backends, report per-item results so partial failures surface (with the failed items kept selected for retry), normalize ancestor/descendant selections server-side, and cap the archive entry and byte counts before any bytes are streamed. Protected compose/.env files are excluded from bulk delete and move but may still be downloaded. * docs(files): document copy, bulk actions, and keyboard navigation Add the copy/duplicate and multi-select bulk delete/move/download sections to the Files & Volumes page, a keyboard-navigation note for the tree, an updated context-menu reference, and bulk troubleshooting entries. * fix(files): inline path-injection barriers at the new file-op sinks CodeQL js/path-injection does not credit the wrapped isPathWithinBase containment check, so the new copy/bulk/disk-upload flows tripped the gate. Inline the canonical path.resolve + startsWith barrier at the realpath sink in resolveSafePathWithin (covers every user-relPath flow) and confirm the multer spool path resolves within UPLOAD_TMP_DIR before unlinking it or streaming it onward. Behavior is unchanged; the paths were already validated. * fix(files): guard the ancestor-walk realpath sink too The first barrier covered realpath(target), but the ENOENT ancestor walk re-derives the path via path.dirname, which static analysis treats as a fresh tainted value. Add the same inline containment barrier before that realpath and resolve the root case via the untainted base, so the only tainted realpath input is one the startsWith check has cleared. Behavior is unchanged. * fix(files): resolve the root case off the taint path in the ancestor walk The compound guard on existing (the same variable as the startsWith subject) was not credited as a sanitizer. Handle the root case before the barrier by resolving the untainted base directly, leaving a plain canonical startsWith guard on the strictly-within ancestor. Behavior is unchanged. * fix(files): harden helper-backend bulk download and uploads Address three issues found in the named-volume (helper) backend: - Bulk download could send 200 headers before discovering a file the helper download path refuses, tearing the archive mid-stream. The prewalk now rejects symlinks, non-regular ("other") entries, and files over the per-file download cap before any header (400/413). FileEntry gains an 'other' type so non-regular entries stay distinct from regular files as they pass through the gateway. - The helper directory listing was fully buffered before the archive entry cap could fire. listDir now accepts a limit; the list script stops after limit+1 rows and the gateway reports truncation. - A stdin pipeline error during a helper upload masked the container's real nonzero exit code (and its 4xx mapping) as a generic 500. The nonzero exit now wins; the masked stream error is logged. * feat(files): add a New file toolbar button with server-enforced create-only The stack file explorer could create a folder from a toolbar button but a new file only from a folder's right-click menu, so a file could not be created at the stack root at all. Add a New file toolbar button beside New folder, targeting the current directory. Creating a file now routes through a new createEmptyStackFile helper that posts a zero-byte file through the existing upload endpoint with overwrite off, so the server's exclusive-create path rejects an existing name instead of clobbering it. A file collision surfaces inline in the dialog; a folder collision and other failures surface as a toast. * fix(files): widen the tree row hit area and add horizontal scroll for long names Right-clicking a file tree row only opened the Sencho context menu when the click landed on the filename; the rest of the row fell through to the native browser menu, and long names were truncated with no way to read them. Make each row span the full pane width (and grow with its content) so the whole row is the context-menu trigger, and let the tree scroll horizontally so a long name is reachable instead of clipped. A new opt-in horizontal prop on ScrollArea adds the styled horizontal scrollbar without clamping content width. * docs(files): document the New file button, full-row right-click, and long-name scrolling * test(files): cover createEmptyStackFile targeting the stack root Add an API-layer case for the empty-directory (stack root) create path, the primary reason the New file toolbar button exists, so a regression in the root-level URL would be caught at unit speed rather than only in e2e.	2026-06-22 19:33:06 -04:00
Anso	b9d8e9f490	feat(stacks): browse and edit mounted volume files in the explorer (#1403) ... * feat(stacks): browse and edit mounted volume files in the explorer Reposition the stack file explorer around runtime configuration access: discover a stack's declared mounts and expose each as a safe, stack-scoped file root. The explorer opens on a Volumes group (bind mounts and named Docker volumes) by default, with the stack source directory as a secondary group, on a "Files & Volumes" tab. - Discover roots from the rendered effective compose model; resolve named volumes to their Docker name and browse/edit them through the hardened helper container, with bind mounts handled directly when reachable. - Re-derive the allowed roots server-side on every file operation and match the client root id against them, so a request can never address a path the stack did not declare. Block dangerous host mounts and binds that overlap Sencho's managed directories; reject writes to read-only mounts. - Thread an optional root id through the existing file endpoints and an opaque, parseable optimistic-concurrency token through read, conflict, and write, for both filesystem and helper backends. - Keep compose and env file protection on the stack source root only. * fix(stacks): theme the Files & Volumes root switcher Replace the raw native select in the file-root switcher with the design system Select component. The native control did not honour the dark theme, so the panel rendered white with unreadable text. The themed Select gives a dark popover with grouped Volumes / Stack source labels and disabled items. * fix(stacks): contain the bind-root probe and de-taint the file-op error log Gate the volume-root bind probe's realpath/stat behind a compose-base containment check (mirroring the storage host-path probe) so they never run on an unvalidated host path; a source outside the compose dir is unreachable in the containerized deployment anyway and is reported non-accessible without touching the filesystem. Log the helper-backed file-op failure through a constant format string with sanitized arguments instead of an interpolated template literal. * fix(stacks): inline the bind-probe containment guard at the fs sinks The wrapped containment predicate was not recognized as a path barrier, so the bind probe's realpath/stat still flagged as uncontrolled-data-in-path. Inline the path.resolve + startsWith check directly at each filesystem sink (and re-check the resolved canonical before stat, so a within-base symlink that resolves outside the compose dir is also rejected). * fix(stacks): harden file-root lifecycle, upload race, and helper errors Address review findings on the Files & Volumes feature: - Invalidate the file-root allowlist on stack create/delete/import/from-git (wire StackFileRootsService.invalidateNode into invalidateNodeCaches), so a stack deleted and recreated under the same name cannot serve the old stack's roots from the 15s cache. - Use the atomic exclusive write for a non-overwrite upload so a file created by another writer after the existence check is not silently clobbered. - Let the helper's real cd errno through and map permission failures to 403 consistently across list/stat/read/write/mkdir/delete/pathKind, instead of reporting EACCES as 404/500; pathKind no longer reports a permission-denied parent as absent. - Document the realpath-then-open TOCTOU as a known, pre-existing limitation of every file op (O_NOFOLLOW is not viable because config volumes legitimately contain symlinks); the bind root is contained to the compose dir and the op requires stack:edit. - Docs: drop a missing screenshot reference and correct the protected-file delete behavior (stack-root compose/.env cannot be deleted via the explorer).	2026-06-21 18:16:20 -04:00
Anso	888f658a7a	feat(files): move files and folders across directories in the stack explorer (#1373) ... * feat(files): move files and folders across directories in the stack explorer Add a cross-directory move to the stack file explorer. Files and folders can be relocated either through a "Move to..." context-menu item that opens a folder-picker dialog, or by dragging an entry onto a folder node (or onto the root area to move it to the stack root). The backend reuses the existing rename endpoint: renameStackPath now resolves both ends through the leaf helper, so a symlink moves as the link entry rather than its target, and it guards against moving a directory into its own subtree. A cross-filesystem rename surfaces as a clean 409 instead of a 500. Protected root files (compose / docker-compose / .env) stay put. Moving the open file, or a folder containing it, deselects the viewer; a move that would discard unsaved edits is blocked with a clear message. * fix(files): fold case in move guards and keep the move dialog open on failure Harden the cross-directory move against case-insensitive filesystems and fix a dialog dismissal edge: - Protected root files (compose / docker-compose / .env) were gated by an exact, lowercase name match. On a case-insensitive filesystem a request like COMPOSE.YAML resolves to the real compose.yaml and slipped past the gate, so a protected file could be moved out of the stack root via the API. The gate now folds case on case-insensitive platforms; Linux stays case-sensitive, where a differently-cased name is a distinct, unprotected file. - The directory-into-descendant guard compared resolved paths case-sensitively, so a source supplied with non-disk casing skipped the guard and fell through to an opaque OS error (500) instead of a clean 400. The comparison now folds case the same way. - The move dialog closed after awaiting the move regardless of outcome, so a blocked move (unsaved edits) or a failed move dismissed the picker as if it had succeeded. The shared handler now reports success and the dialog only closes on an actual move.	2026-06-14 21:56:06 -04:00
Anso	c2357ec534	fix(stack-files): symlink-aware delete and chmod (#1214) ... deleteStackPath now lstats the leaf and unlinks the link entry itself when it is a symbolic link, so the file the user clicked on in the tree is what gets removed (the linked target stays intact). chmodStackPath rejects with LINK_CHMOD_UNSUPPORTED on a symlink rather than silently mutating the target's permissions; Node's lchmod is macOS-only and following the link is the bug being fixed here. Path-component symlinks are still resolved via the existing resolveSafeStackPath, so a symlinked parent that escapes the stack dir still surfaces SYMLINK_ESCAPE before the leaf is inspected. Service-level tests cover delete on internal-target / external-target / broken / dir-target symlinks, chmod rejection on symlinks (including the broken case), and non-symlink regression checks. Route-level tests pin the 409 LINK_CHMOD_UNSUPPORTED mapping and the link-only-delete behaviour. The describe blocks are platform-gated; Windows symlink creation needs admin/developer-mode and is skipped along with the existing SYMLINK_ESCAPE test. Docs updated to describe both behaviours in plain product terms.	2026-05-25 01:30:00 -04:00
Anso	668eda6cc8	fix(stack-files): atomic write via tmp+rename with optional exclusive mode (#1205) ... * fix(stack-files): atomic write via tmp+rename with optional exclusive mode writeStackFile and writeStackFileBuffer previously called fs.writeFile directly, which truncates the target then streams the new bytes. A crash, disk-full event, or process kill between the truncate and the write left the target with partial content and no easy way to detect the half-write at read time. A private writeStackFileAtomic helper stages every write into a sibling .sencho-tmp-<suffix> file in the same directory, fsyncs, then promotes via fs.rename. A crash now leaves either the original target intact or a leftover .sencho-tmp file (cleaned up on the next failure path); a torn target file is no longer reachable through this path. The helper accepts an optional `exclusive: true` flag that swaps the final promote step from rename to link+unlink. link is atomic against EEXIST so a caller that needs "create only if not present" gets a race-free FILE_EXISTS error instead of a clobber. The upload route's overwrite-confirm flow (PR #1204) will wire this through in a follow-up so the existence check becomes authoritative. Behaviour for current callers (writeStackFile, writeStackFileBuffer, BlueprintService deploy) is unchanged: the non-exclusive default matches the prior fs.writeFile semantics from the caller's perspective. * fix(stack-files): tighten atomic write entropy + concurrent / failure tests Tmp suffix now uses crypto.randomBytes(6) so the per-process collision window is a true 48-bit space (Math.random().toString(36).slice(2,6) could drop leading zeros and narrow entropy unpredictably). Adds a short comment on the Windows link path noting NTFS / same-FS POSIX is required, both guaranteed by tmp+target being siblings. Two new tests close coverage gaps the first round missed: - a write step that throws (writeFile rejected) leaves no tmp leak and no partial target; - concurrent non-exclusive writers settle with at least one success and the final file is exactly one of the inputs (POSIX silently overwrites; Windows EPERMs the loser, both consistent).	2026-05-24 23:34:26 -04:00
Anso	801a098a5b	feat(files): per-stack file explorer (#780) ... * feat(files): backend foundation for stack file explorer Install multer for multipart file upload handling. Add isValidRelativeStackPath to validation.ts to guard client-supplied relative paths against traversal, absolute paths, NUL bytes, backslash injection, and double-slash segments. Add isBinaryBuffer to a new binaryDetect.ts utility for heuristic text/binary detection via NUL-byte fast exit and non-printable byte ratio sampling. * fix(files): reject bare dot segments in isValidRelativeStackPath * feat(files): add safe stack-scoped file I/O methods to FileSystemService Adds FileEntry interface and seven new public methods to FileSystemService for stack-scoped file operations: listStackDirectory, readStackFile, streamStackFile, writeStackFile, deleteStackPath, mkdirStackPath, and statStackEntry. Each method routes through a private resolveSafeStackPath helper that enforces two-phase path containment: a pre-realpath lexical check plus a post-realpath symlink-escape check. ENOENT targets are handled by walking up to the deepest existing ancestor, realpaths that ancestor, and reattaching the remaining suffix. Binary detection delegates to isBinaryBuffer; path safety delegates to isPathWithinBase. Protected file names and the MIME map are module-level constants to avoid repeated allocation. * feat(files): frontend API wrappers and Monaco language helper * fix(files): tighten stackFilesApi error handling and localOnly support * fix(files): FileSystemService safety and correctness fixes * feat(files): add file explorer API endpoints to stacks router * feat(files): FileTree and FileTreeNode components * fix(files): route security hardening and stream cleanup * fix(files): FileTree accessibility, icon stroke, stale fetch guard Add strokeWidth={1.5} to all Lucide icons in FileTreeNode to match the design system. Add aria-expanded to directory rows for accessibility. Guard handleDirClick .then() callbacks against stale stack name references when the component re-renders with a new stack. Add toast.info fallbacks when compose.yaml or .env is clicked without a navigation callback registered. * feat(files): FileViewer, FileUploadDropzone, NewFolderDialog, DeleteFileConfirm * fix(files): resolve code quality findings in file explorer components - Move editorOptions useMemo above conditional returns in FileViewer (Rules of Hooks fix) - Fix blob download: append anchor to DOM before click, defer URL revoke 100ms - Keep protected-file confirm input visible during NOT_EMPTY recursive retry in DeleteFileConfirm - Remove non-functional cursor-pointer/onClick from Community upgrade pill in FileUploadDropzone - Add success toast on folder creation in NewFolderDialog - Switch all (e as Error).message casts to instanceof Error narrowing * test(files): unit tests for binary detection, stack path safety, and file explorer routes - binary-detection.test.ts: covers isBinaryBuffer edge cases (empty, NUL, PNG header, threshold boundary, sampleBytes parameter) - filesystem-stack-paths.test.ts: covers isValidRelativeStackPath (accepts/ rejects matrix) and FileSystemService stack methods against a real temp dir (listStackDirectory sort and protection flags, readStackFile text/binary/ oversized paths, writeStackFile/Buffer, deleteStackPath, mkdirStackPath, traversal guard); platform-specific empty-dir/NOT_EMPTY cases skip on Windows - stack-files-routes.test.ts: route-level integration tests for all seven file explorer endpoints; covers auth gating, Community-tier 403 gates, input validation, 413 TOO_LARGE upload limit, and 204/200 happy paths * feat(files): StackFileExplorer container with lazy tree, viewer, and action bar * fix(files): add Download button to explorer toolbar, fix Community upgrade pill, reset state on stack change * test(files): add missing test coverage for file explorer routes and service * feat(files): add Files tab to EditorLayout with StackFileExplorer integration * fix(files): add defensive activeTab guard to saveFile and discardChanges * test(files): unit tests for FileTree expand/collapse and FileViewer render modes Covers the three FileViewer content modes (text/Monaco, binary panel, oversized panel) and the FileTree expand/collapse/cache cycle: first expand fetches the subdirectory, second click collapses without a fetch, third click re-expands from the in-memory cache without a second fetch. * test(e2e): file explorer community and skipper+ flows Covers the full file-explorer feature surface in two describe blocks: Community (read-only): intercepts /api/license to simulate community tier, confirms the upgrade pill is visible in the left pane, and asserts that the Save button is absent after opening a text file. Skipper+ (full CRUD): uploads a text file and confirms it appears in the tree; edits config/app.conf and saves via Monaco; deletes an uploaded file and asserts the tree entry is gone; issues a raw HTTP request to the download endpoint and checks for status 200 and the content-disposition: attachment header. Also adds data-testid="file-action-delete" to the action bar Delete button in StackFileExplorer for stable targeting, and exports waitForStacksLoaded from e2e/helpers.ts to eliminate the three identical local copies in stacks, deploy-log-panel, and stack-files spec files. * fix(e2e): improve test isolation and selector stability in stack-files spec Move beforeEach seed to beforeAll/afterAll so fixtures are created once per suite, not before every test. Extract shared seedSuite/teardownSuite helpers to eliminate the duplicate beforeAll/afterAll blocks. Wrap teardown in try/catch so failures log a warning rather than masking test results. Replace waitForTimeout(500) with a deterministic expect on the file tree sentinel. Add data-testid="anatomy-files-btn" and data-testid="delete-confirm-btn" to replace the fragile button text/positional selectors. Assert Save button starts disabled before editing. * docs(files): add stack file explorer documentation Add user-facing guide for the stack file explorer feature covering tier access (Community read-only, Skipper+ read-write), viewing limits, upload/download caps, protected file routing, and troubleshooting. Update the editor page to reference the new guide and register the page in the navigation. * fix(docs): use canonical Skipper tier name in file explorer overview card * fix(files): resolve lint errors blocking CI Remove unnecessary backslash escape before double-quote in the Content-Disposition regex (no-useless-escape). Replace five synchronous setState resets at the top of the FileTree mount effect with a React key prop on the FileTree element in StackFileExplorer so remounting resets state automatically, eliminating the react-hooks/set-state-in-effect violation. * test(files): fix e2e seeding to work on community-tier CI Replace the browser-side paid upload/mkdir API calls in seedTestStack with direct Node fs writes. The upload and folder endpoints require Skipper+ so they returned 403 on CI, which runs with no license set. Stack creation via POST /api/stacks stays as an API call since it is community-allowed and keeps the backend registry in sync. Add a per-test tier check in the Skipper+ beforeEach that skips gracefully when the instance is community, matching the pattern in auto-heal-policies.	2026-04-26 13:05:19 -04:00