Function handleFileRequest

ts/workflow-cli/server/fileBridge.ts:65–125

(
  req: IncomingMessage,
  res: ServerResponse,
  allowedRoots: string[],
)

 * dev (mounted) and static (unmounted) servers parse requests identically.
 */
export async function handleFileRequest(
  req: IncomingMessage,
  res: ServerResponse,
  allowedRoots: string[],
): Promise<boolean> {
  const url = new URL(req.url ?? "", "http://localhost");
  if (url.pathname !== "/api/file") return false;

  if (!isTrustedRequest(req)) {
    res.statusCode = 403;
    res.end("forbidden: non-local request");
    return true;
  }

  try {
    const filePath = url.searchParams.get("path");
    if (!filePath) {
      res.statusCode = 400;
      res.end("missing ?path=");
      return true;
    }
    const abs = path.resolve(filePath);
    if (!isAllowed(abs, allowedRoots)) {
      res.statusCode = 403;
      res.end(`path not under an allowed root: ${abs}`);
      return true;
    }

    if (req.method === "GET") {
      try {
        const content = await fs.readFile(abs, "utf-8");
        res.setHeader("Content-Type", "application/json");
        res.end(content);
      } catch (err: unknown) {
        const code = (err as NodeJS.ErrnoException).code;
        res.statusCode = code === "ENOENT" ? 404 : 500;
        res.end(code ?? "read failed");
      }
      return true;
    }

    if (req.method === "PUT") {
      const chunks: Buffer[] = [];
      for await (const chunk of req) chunks.push(chunk as Buffer);
      const body = Buffer.concat(chunks).toString("utf-8");
      await fs.writeFile(abs, body, "utf-8");
      res.statusCode = 204;
      res.end();
      return true;
    }

    res.statusCode = 405;
    res.setHeader("Allow", "GET, PUT");
    res.end("method not allowed");
    return true;
  } catch (err: unknown) {
    res.statusCode = 500;
    res.end(err instanceof Error ? err.message : String(err));