Merge upstream/main 15fe283272 into coder-only

apps/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t3",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "license": "MIT",
   "type": "module",
   "scripts": {

apps/server/scripts/acp-mock-agent.ts

@@ -58,8 +58,10 @@ const failSetModeConfigOption = process.env.T3_ACP_FAIL_SET_MODE_CONFIG_OPTION =
 const emitEmptyDefaultAgentOption = process.env.T3_ACP_EMIT_EMPTY_DEFAULT_AGENT_OPTION === "1";
 const promptResponseText = process.env.T3_ACP_PROMPT_RESPONSE_TEXT;
 const promptDelayMs = Number(process.env.T3_ACP_PROMPT_DELAY_MS ?? "0");
+const terminalOutputBytes = Number(process.env.T3_ACP_EMIT_TERMINAL_OUTPUT_BYTES ?? "0");
 const supportsSessionLifecycle = process.env.T3_ACP_SESSION_LIFECYCLE === "1";
 const supportsAcpMcp = process.env.T3_ACP_MCP_ACP === "1";
+const supportsHttpMcp = process.env.T3_ACP_MCP_HTTP === "1";
 const supportsV2Management = process.env.T3_ACP_V2_MANAGEMENT === "1";
 const advertisedAuthMethodId = process.env.T3_ACP_AUTH_METHOD_ID?.trim();
 const initializeAuthMethodId =
@@ -505,7 +507,14 @@ const program = Effect.gen(function* () {
           session: {
             ...(supportsSessionLifecycle ? { fork: {}, additionalDirectories: {} } : {}),
             ...(supportsV2Management ? { delete: {} } : {}),
-            ...(supportsAcpMcp ? { mcp: { acp: {} } } : {}),
+            ...(supportsAcpMcp || supportsHttpMcp
+              ? {
+                  mcp: {
+                    ...(supportsAcpMcp ? { acp: {} } : {}),
+                    ...(supportsHttpMcp ? { http: {} } : {}),
+                  },
+                }
+              : {}),
           },
           ...(supportsV2Management ? { providers: {} } : {}),
         },
@@ -1020,6 +1029,36 @@ const program = Effect.gen(function* () {
         return yield* finishPrompt(requestedSessionId, "end_turn");
       }
 
+      if (terminalOutputBytes > 0) {
+        const terminalId = "long-output";
+        yield* agent.client.sessionUpdate({
+          sessionId: requestedSessionId,
+          update: { sessionUpdate: "terminal_update", terminalId, command: "print long output" },
+        });
+        // 4 KiB chunks of 64-char numbered lines, like a long build log.
+        for (let line = 0; line * 64 < terminalOutputBytes; line += 64) {
+          let chunk = "";
+          for (let i = line + 1; i <= line + 64; i++) {
+            chunk += `${String(i).padStart(8, "0")} ${"x".repeat(54)}\n`;
+          }
+          yield* agent.client.sessionUpdate({
+            sessionId: requestedSessionId,
+            update: {
+              sessionUpdate: "terminal_output_chunk",
+              terminalId,
+              data: Buffer.from(chunk)
+                .subarray(0, terminalOutputBytes - line * 64)
+                .toString("base64"),
+            },
+          });
+        }
+        yield* agent.client.sessionUpdate({
+          sessionId: requestedSessionId,
+          update: { sessionUpdate: "terminal_update", terminalId, exitStatus: { exitCode: 0 } },
+        });
+        return yield* finishPrompt(requestedSessionId, "end_turn");
+      }
+
       if (emitNotice) {
         // A notice in fx 0.0.14's shape for a skipped skill, between two chunks of one message.
         const chunk = (text: string) =>

apps/server/src/assets/AssetAccess.test.ts

@@ -631,6 +631,51 @@ describe("AssetAccess", () => {
       }).pipe(Effect.provide(layerTest)),
   );
 
+  it.effect.skipIf(!symlinksSupported)("does not issue URLs for server state files", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const config = yield* ServerConfig.ServerConfig;
+      const stateFile = path.join(config.secretsDir, "example.bin");
+      yield* fs.makeDirectory(config.secretsDir, { recursive: true });
+      yield* fs.writeFile(stateFile, new Uint8Array(32).fill(7));
+      yield* fs.writeFileString(config.dbPath, "SQLite format 3");
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-state-" });
+      const alias = path.join(root, "alias");
+      yield* fs.symlink(stateFile, alias);
+      const threadId = ThreadId.make("thread-1");
+      for (const resource of [
+        { _tag: "media-file", threadId, path: stateFile, disposition: "attachment" },
+        { _tag: "media-file", threadId, path: alias, disposition: "attachment" },
+        {
+          _tag: "media-file",
+          threadId,
+          path: path.join(config.secretsDir, "..", "secrets", "example.bin"),
+          disposition: "attachment",
+        },
+        { _tag: "media-file", threadId, path: config.dbPath },
+        { _tag: "draft-workspace-file", cwd: config.stateDir, path: "statev2.sqlite" },
+      ] as const) {
+        const error = yield* issueAssetUrl({ resource }).pipe(Effect.flip);
+        expect(error._tag).toBe("AssetWorkspaceAssetNotFoundError");
+      }
+
+      const icon = path.join(config.baseDir, "icon.png");
+      yield* fs.symlink(stateFile, icon);
+      yield* fs.writeFileString(path.join(config.baseDir, "page.html"), '<img src="icon.png">');
+      const page = yield* issueAssetUrl({
+        resource: { _tag: "draft-workspace-file", cwd: config.baseDir, path: "page.html" },
+      });
+      const pageToken = page.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length).split("/")[0]!;
+      expect(yield* resolveAsset(pageToken, "icon.png")).toBeNull();
+      const faviconError = yield* issueAssetUrl({
+        resource: { _tag: "project-favicon", cwd: root },
+        projectFaviconPath: icon,
+      }).pipe(Effect.flip);
+      expect(faviconError._tag).toBe("AssetProjectFaviconNotFoundError");
+    }).pipe(Effect.provide(layerTest)),
+  );
+
   it.effect.skipIf(!symlinksSupported)(
     "binds media URLs to the canonical target and rejects symlink substitution",
     () =>

apps/server/src/assets/AssetAccess.ts

@@ -53,6 +53,7 @@ import {
   timingSafeEqualBase64Url,
 } from "../auth/utils.ts";
 import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
+import { makeIsServerInternalPath } from "../auth/serverInternalPaths.ts";
 import { parseAttachmentFileExtension, resolveAttachmentPathById } from "../attachmentStore.ts";
 import * as ServerConfig from "../config.ts";
 import * as Orchestrator from "../orchestration-v2/Orchestrator.ts";
@@ -274,7 +275,9 @@ const resolveCanonicalFile = Effect.fn("AssetAccess.resolveCanonicalFile")(funct
   if (Option.isNone(canonicalFile)) return null;
 
   const info = yield* ProjectFaviconResolver.optionOnNotFound(fileSystem.stat(canonicalFile.value));
-  return Option.isSome(info) && info.value.type === "File" ? canonicalFile.value : null;
+  if (Option.isNone(info) || info.value.type !== "File") return null;
+  const isServerInternalPath = yield* makeIsServerInternalPath;
+  return (yield* isServerInternalPath(canonicalFile.value)) ? null : canonicalFile.value;
 });
 
 const resolveCanonicalWorkspaceFile = Effect.fn("AssetAccess.resolveCanonicalWorkspaceFile")(
@@ -302,7 +305,9 @@ const resolveCanonicalWorkspaceFile = Effect.fn("AssetAccess.resolveCanonicalWor
     const info = yield* ProjectFaviconResolver.optionOnNotFound(
       fileSystem.stat(canonicalFile.value),
     );
-    return Option.isSome(info) && info.value.type === "File" ? canonicalFile.value : null;
+    if (Option.isNone(info) || info.value.type !== "File") return null;
+    const isServerInternalPath = yield* makeIsServerInternalPath;
+    return (yield* isServerInternalPath(canonicalFile.value)) ? null : canonicalFile.value;
   },
 );
 

apps/server/src/auth/serverInternalPaths.ts

@@ -0,0 +1,29 @@
+// @effect-diagnostics nodeBuiltinImport:off - Effect's realPath keeps the requested letter case.
+import * as NodeFSP from "node:fs/promises";
+
+import * as Effect from "effect/Effect";
+import * as Path from "effect/Path";
+
+import * as ServerConfig from "../config.ts";
+import { isWithinRoot } from "../workspace/KnownWorkspaces.ts";
+
+/** Builds a check for the server's own state files, which client file reads do not serve. */
+export const makeIsServerInternalPath = Effect.gen(function* () {
+  const config = yield* ServerConfig.ServerConfig;
+  const path = yield* Path.Path;
+  // Native realpath returns the on-disk letter case.
+  const realPath = (value: string) =>
+    Effect.promise(() => NodeFSP.realpath(value).catch(() => path.resolve(value)));
+  return Effect.fn("ServerInternalPaths.isServerInternalPath")(function* (filePath: string) {
+    const [file, stateDir, secretsDir] = yield* Effect.all(
+      [realPath(filePath), realPath(config.stateDir), realPath(config.secretsDir)],
+      { concurrency: "unbounded" },
+    );
+    return (
+      isWithinRoot(path, file, secretsDir) ||
+      (path.dirname(file) === stateDir && path.basename(file).includes(".sqlite")) ||
+      // macOS does not resolve `/dev/fd/N` to the open file's path.
+      isWithinRoot(path, file, "/dev/fd")
+    );
+  });
+});

apps/server/src/coderEnvironment.ts

@@ -59,6 +59,7 @@ export const CODER_ENVIRONMENT_CAPABILITIES = {
   fileAttachments: { maxUploadBytes: PROVIDER_SEND_TURN_MAX_FILE_BYTES },
   pullRequests: true,
   pullRequestChecks: true,
+  sideChats: true,
   inlineMessageContext: true,
   requiredWorktreeBootstrap: true,
   threadSettlement: true,
@@ -91,6 +92,7 @@ export const CODER_ENVIRONMENT_CAPABILITIES = {
   localServerStop: true,
   environmentIcon: true,
   projectCloneTracking: true,
+  projectOrganization: true,
   threadProjectFromScratch: true,
   // Links are the gateway's workspace link rules; calls between workspaces go through its hub.
   peerLinks: true,