INFINITY 988fd6db5e feat: import existing local folder as project (#597) (#624) ... * feat(contracts): types for folder-import endpoint Add ImportFolderRequest, ImportFolderResponse to the public contract surface. Extend ProjectMetadata with a baseDir field — when set, the project's files live at this absolute path instead of .od/projects/<id>/. Stored as the realpath() result so symlinks cannot redirect later writes. Refs nexu-io/open-design#597 * feat(daemon): support metadata.baseDir for folder-rooted projects Add resolveProjectDir() and metadata-aware variants of listFiles, readProjectFile, writeProjectFile, ensureProject so a project's files can live under metadata.baseDir (the user's chosen folder) instead of .od/projects/<id>/. metadata.baseDir is opt-in — projects without it keep the existing .od/projects/<id>/ behavior unchanged. When listFiles walks a baseDir-rooted project, it skips conventional build / install dirs (node_modules, .git, dist, build, .next, .nuxt, .turbo, .cache, .output, out, coverage, __pycache__, .venv, vendor, target, .od, .tmp) so the file panel stays focused on design content instead of being dominated by lockfiles and node_modules. Add detectEntryFile() — best-effort lookup for index.html or any .html at the folder root, used by the import endpoint to seed the initial active tab. Refs nexu-io/open-design#597 * feat(daemon): add POST /api/import/folder endpoint Creates a project rooted at the submitted local folder. metadata.baseDir points at that folder and OD reads / writes there directly — no copy, no shadow tree, mirroring how Cursor / Claude Code / Aider behave. The user owns the workspace and is responsible for their own version control. Safety: - baseDir is canonicalized via fs.promises.realpath() at import time so user-controlled symlinks can't redirect later writes. resolveSafe enforces the bounds check against the literal stored path; without realpath, a symlink (e.g. ~/sneaky → /etc) would let writeProjectFile escape the project tree at every later call because the OS follows the symlink at open() time. - Post-realpath lstat ensures the canonical target is itself a real directory (defense-in-depth). - The data directory (RUNTIME_DATA_DIR) and its descendants are refused after symlink resolution so a redirect into the daemon's own state can't masquerade as a project import. The web client wires this through state/projects.ts → App.tsx, landing the user on the auto-detected entry file when present. Refs nexu-io/open-design#597 * feat(desktop): expose native folder picker to renderer Adds an Electron preload script that exposes window.electronAPI.pickFolder via contextBridge. Wires dialog.showOpenDialog through ipcMain so the web UI can open a native folder selector for project import. Browser-only users fall back to a text input for the absolute path (handled in the web layer); the picker stays an optional convenience on the desktop binary. ipcMain.handle() registers handlers in an internal map that is not exposed via eventNames(), so the natural-looking guard if (!ipcMain.eventNames().includes('dialog:pick-folder')) ipcMain.handle(...) is always true. On a second createDesktopRuntime() call (dev hot-reload, packaged-vs-electron mode swap) the body re-runs and ipcMain.handle() throws 'Attempted to register a second handler'. Use removeHandler() + handle() unconditionally — removeHandler() is a documented no-op when nothing is registered, making the pair idempotent. Includes *.cts in the apps/desktop tsconfig so the preload script is typechecked. Refs nexu-io/open-design#597 * feat(web): add 'From existing folder' option to New Project UI surface for the import flow: - A new 'Open folder' affordance in NewProjectPanel that uses the native picker on Electron (window.electronAPI.pickFolder) and falls back to an absolute-path text input in the browser. - importFolderProject() in state/projects.ts: typed wrapper around POST /api/import/folder using @open-design/contracts types. - App.tsx wires the response: prepend the new project to the list, navigate to it, and select the auto-detected entry file as the active tab. Skill / design-system pickers from the existing prototype tab are reused — folder import is a project-creation flow, not a separate project type. Refs nexu-io/open-design#597 * docs(architecture): document folder-import endpoint Adds POST /api/import/folder to the daemon API table and a 'Folder import' section explaining the single-mode design (direct read/write in metadata.baseDir, mirroring Cursor / Claude Code / Aider), the realpath() canonicalization, the RUNTIME_DATA_DIR refusal, and the SKIP_DIRS list applied to listFiles for baseDir-rooted projects. Refs nexu-io/open-design#597 * test(daemon): unit + integration tests for folder import Two new files: apps/daemon/tests/folder-import-projects.test.ts (13 unit tests): - resolveProjectDir behavior under all metadata combinations, including the fallback when baseDir is relative and the isSafeId-bypass when baseDir is set - detectEntryFile: index.html priority, .html fallback, null when no html, no descent into subdirs - listFiles with metadata.baseDir: walk, SKIP_DIRS hides node_modules / .git / dist, back-compat for projects without baseDir apps/daemon/tests/folder-import-route.test.ts (10 integration tests): - Happy path: baseDir stored in metadata, importedFrom='folder', conversation created, entry file detected - Error paths: missing baseDir, empty, relative, non-existent, pointing at a file - Security: realpath canonicalization (the symlink test was the one that surfaced the original /var vs /private/var mismatch in RUNTIME_DATA_DIR comparison on macOS) - Security: a symlink that resolves into RUNTIME_DATA_DIR is rejected after realpath, not before Refs nexu-io/open-design#597 * fix(daemon): wire baseDir metadata into chat + deploy reads Two bugs caught in Codex automated review of #624: 1. chat-route was passing the metadata object directly as the listFiles opts argument: `listFiles(PROJECTS_DIR, projectId, chatMeta)`. The listFiles contract reads opts.metadata, not opts itself, so this silently fell back to .od/projects/<id>/ instead of the imported folder. existingProjectFiles was empty for baseDir-rooted projects. Wrap as `{ metadata: chatMeta }`. 2. deploy.ts read project files via readProjectFile without the metadata third argument, so for baseDir-rooted projects the deploy and preflight endpoints would look in .od/projects/<id>/ and fail with file-not-found instead of reading the imported folder. Thread options.metadata through buildDeployFilePlan → readProjectFile and pass project?.metadata at the two server.ts callsites (`POST /api/projects/:id/deploy` and the preflight endpoint). Add a regression test that locks the listFiles contract: passing a bare metadata object as opts must NOT scan baseDir — it must fall back to the standard project dir, otherwise callers can leak the wrong folder by mistake. Refs nexu-io/open-design#597, #624 (Codex review) * fix(daemon): ensure correct metadata handling in folder import Addressed issues with metadata handling in folder import functionality. Updated the listFiles and readProjectFile methods to correctly utilize the metadata.baseDir, ensuring that project files are read from the intended directory. Added regression tests to verify that passing a bare metadata object does not inadvertently scan the baseDir, maintaining the integrity of project file access. Refs nexu-io/open-design#597 * fix(daemon): security hardening from Codex review of #624 P1 findings from automated review: 1. POST /api/projects + PATCH /api/projects/:id rejected client-supplied metadata.baseDir. baseDir is privileged: it lets a project root inside the user's filesystem, and the realpath() + RUNTIME_DATA_DIR reentry checks live only on /api/import/folder. Allowing it on the generic create/patch path lets an attacker smuggle e.g. /etc through and bypass every import-time guard. Both endpoints now refuse a baseDir field with 400. 2. resolveSafeReal() helper: realpath()s each candidate path (or its longest existing prefix for write paths) and re-validates against realpath(projectRoot). The original resolveSafe() only did a string-prefix check, which was fooled by symlinks *inside* a baseDir-rooted project. A repo containing 'assets -> /Users/me/.ssh' passed the literal prefix check but readFile() followed the link at open() time. resolveSafeReal() is now used by readProjectFile, writeProjectFile, and deleteProjectFile. 3. Multer chat-upload destination now resolves to metadata.baseDir for imported folder projects via a module-level lookup wired to db at startServer() boot. Previously attachments landed in .od/projects/<id>/ even for baseDir projects, so the agent (which runs with cwd=baseDir) couldn't open them. P2 findings: 4. searchProjectFiles threads metadata through listFiles + resolveProjectDir so /api/projects/:id/search hits the right tree. 5. buildProjectArchive + buildBatchArchive now accept metadata so 'Download .zip' works for imported folder projects. 6. Watcher subscribe() resolves to baseDir for imported projects so live-reload SSE actually fires when the user edits files in their own folder. Registry stays keyed by the canonical directory. 7. Template snapshotting reads source-project files with metadata so a template can be saved from a baseDir-rooted source. Tests: - Regression: POST /api/projects with metadata.baseDir → 400. - Regression: descendant symlink (assets/leak.txt -> /etc/hosts) is refused on the raw read endpoint. Refs nexu-io/open-design#597, #624 (Codex P1+P2 review) * fix(daemon): close two regressions found in #624 review round 2 @mrcfps caught two more correctness gaps: 1. Archive root symlink escape — buildProjectArchive accepts an optional ?root=<subdir> param to scope the zip to a subdirectory. The path was resolved with the string-only resolveSafe(), so a directory symlink inside an imported folder (docs -> /Users/me/.ssh) passed the prefix check and collectArchiveEntries() then walked outside the project tree. Switch to the symlink-aware resolveSafeReal() — the same one that already protects raw read/write/delete paths. The walker itself already skips dirent symlinks via !isDirectory && !isFile, so canonicalizing the root is the only missing piece. 2. PATCH metadata wiped baseDir — updateProject() replaces metadata wholesale. The previous guard only blocked an explicit baseDir change, but a normal patch that *omits* baseDir (a UI editing linkedDirs only sends { metadata: { kind, linkedDirs } }) silently detached imported projects from their folder root. Subsequent reads/writes/watch/deploy fell back to .od/projects/<id>. Re-stamp the immutable folder-import fields (baseDir, importedFrom='folder') from the existing project record onto the incoming patch when the project is imported. A patch that supplies a *different* baseDir still gets rejected as before; a patch that supplies the *same* baseDir is accepted as a no-op. A patch on a non-imported project that tries to set baseDir is also still rejected (preserves the POST /api/projects guard from the previous round). Tests: - archive endpoint: ?root=<symlink-to-/etc> → 400. - patch endpoint: PATCH that omits baseDir on an imported project keeps baseDir intact (project still resolves to the user's folder after). Refs nexu-io/open-design#597, #624 (Codex P1 round 2) * fix(web): add Indonesian deploy provider copy --------- Co-authored-by: INFINITY <valentyn.sotov@trendarena.app> Co-authored-by: Siri-Ray <2667192167@qq.com>		2026-05-07 20:43:31 +08:00
..
dev-server-auto-detect.md	feat: import existing local folder as project (#597) (#624)	2026-05-07 20:43:31 +08:00