Documentation
¶
Overview ¶
Package filehandler provides HTTP endpoints for browsing, reading, editing, uploading, and downloading files. The browsable surface is an ALLOW-LIST of granted roots (the /workspace and /config mounts by default, plus any VIBEKIT_BROWSE_ROOTS grants), each kernel-confined through its own os.Root; everything outside the grants is denied by default. A sensitive-path list additionally blocks the credential and state files living inside /config. The URL namespace is the container-absolute path ("/workspace/...", "/config/..."), and "/" lists the granted mounts.
Defense layers are documented on paths.go. The handler is the gatekeeper for everything the user can do from the browser; every route that takes a path runs it through resolveOrForbid so that the symlink-aware resolvePath is applied uniformly. Operations that touch a DIRECTORY (delete, upload target) additionally consult isProtectedDir; operations with a secondary path argument (rename's name, copy/move's dest) re-run the full guard on the new path.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ParseBrowseRoots ¶ added in v0.2.8
ParseBrowseRoots normalises a colon-separated root list (the VIBEKIT_BROWSE_ROOTS format, PATH-style) into cleaned absolute directories. Relative entries and "/" are rejected with an error listing so the caller can log them; duplicates collapse.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler implements api.FileHandler.
func New ¶
New creates a file handler whose browsable surface is exactly rootDirs. Each granted directory gets its own os.Root, so every file operation is kernel-confined to its mount (TOCTOU-free). A grant that cannot be opened is skipped with a warning — a typo'd VIBEKIT_BROWSE_ROOTS entry must not brick the UI — but zero usable mounts is a hard error.
func (*Handler) RegisterRoutes ¶
RegisterRoutes wires all /api/file* and /api/files* routes onto mux.
func (*Handler) SetWriteObserver ¶ added in v0.2.8
func (h *Handler) SetWriteObserver(fn WriteObserver)
SetWriteObserver installs the pre-write hook fired for PUT /api/file saves — the built-in editor path. Deliberately NOT fired for uploads, copies, touch, or other file actions: the editor is the one manual-change surface checkpoints vouch for. Call during composition, before the handler serves requests.
type WriteObserver ¶ added in v0.2.8
WriteObserver is notified synchronously just before an editor write (PUT /api/file) is applied, with the resolved absolute path and the incoming content. The pre-write timing lets the observer capture the file's current disk content as an undo target (mirroring the agent write path's snapshot-then-write ordering); if the write then fails, the phantom capture is the same bounded tradeoff the agent path documents on hub.recordCheckpointSnapshot. Observers must be best-effort: they cannot veto or fail the save.
Source Files