Merge main into massive-terminal-upgrade

Resolves merge conflicts:
- apps/server/src/routes/terminal/common.ts: Keep randomBytes import, use @automaker/utils for createLogger
- apps/ui/eslint.config.mjs: Use main's explicit globals list with XMLHttpRequest and MediaQueryListEvent additions
- apps/ui/src/components/views/terminal-view.tsx: Keep our terminal improvements (killAllSessions, beforeunload, better error handling)
- apps/ui/src/config/terminal-themes.ts: Keep our search highlight colors for all themes
- apps/ui/src/store/app-store.ts: Keep our terminal settings persistence improvements (merge function)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/server/src/routes/workspace/common.ts

@@ -2,13 +2,10 @@
  * Common utilities for workspace routes
  */
 
-import { createLogger } from "../../lib/logger.js";
-import {
-  getErrorMessage as getErrorMessageShared,
-  createLogError,
-} from "../common.js";
+import { createLogger } from '@automaker/utils';
+import { getErrorMessage as getErrorMessageShared, createLogError } from '../common.js';
 
-const logger = createLogger("Workspace");
+const logger = createLogger('Workspace');
 
 // Re-export shared utilities
 export { getErrorMessageShared as getErrorMessage };

apps/server/src/routes/workspace/routes/config.ts

@@ -2,53 +2,56 @@
  * GET /config endpoint - Get workspace configuration status
  */
 
-import type { Request, Response } from "express";
-import fs from "fs/promises";
-import { addAllowedPath } from "../../../lib/security.js";
-import { getErrorMessage, logError } from "../common.js";
+import type { Request, Response } from 'express';
+import * as secureFs from '../../../lib/secure-fs.js';
+import path from 'path';
+import { getAllowedRootDirectory, getDataDirectory } from '@automaker/platform';
+import { getErrorMessage, logError } from '../common.js';
 
 export function createConfigHandler() {
   return async (_req: Request, res: Response): Promise<void> => {
     try {
-      const workspaceDir = process.env.WORKSPACE_DIR;
+      const allowedRootDirectory = getAllowedRootDirectory();
+      const dataDirectory = getDataDirectory();
 
-      if (!workspaceDir) {
+      if (!allowedRootDirectory) {
+        // When ALLOWED_ROOT_DIRECTORY is not set, return DATA_DIR as default directory
         res.json({
           success: true,
           configured: false,
+          defaultDir: dataDirectory || null,
         });
         return;
       }
 
       // Check if the directory exists
       try {
-        const stats = await fs.stat(workspaceDir);
+        const resolvedWorkspaceDir = path.resolve(allowedRootDirectory);
+        const stats = await secureFs.stat(resolvedWorkspaceDir);
         if (!stats.isDirectory()) {
           res.json({
             success: true,
             configured: false,
-            error: "WORKSPACE_DIR is not a valid directory",
+            error: 'ALLOWED_ROOT_DIRECTORY is not a valid directory',
           });
           return;
         }
 
-        // Add workspace dir to allowed paths
-        addAllowedPath(workspaceDir);
-
         res.json({
           success: true,
           configured: true,
-          workspaceDir,
+          workspaceDir: resolvedWorkspaceDir,
+          defaultDir: resolvedWorkspaceDir,
         });
       } catch {
         res.json({
           success: true,
           configured: false,
-          error: "WORKSPACE_DIR path does not exist",
+          error: 'ALLOWED_ROOT_DIRECTORY path does not exist',
         });
       }
     } catch (error) {
-      logError(error, "Get workspace config failed");
+      logError(error, 'Get workspace config failed');
       res.status(500).json({ success: false, error: getErrorMessage(error) });
     }
   };

apps/server/src/routes/workspace/routes/directories.ts

@@ -2,60 +2,58 @@
  * GET /directories endpoint - List directories in workspace
  */
 
-import type { Request, Response } from "express";
-import fs from "fs/promises";
-import path from "path";
-import { addAllowedPath } from "../../../lib/security.js";
-import { getErrorMessage, logError } from "../common.js";
+import type { Request, Response } from 'express';
+import * as secureFs from '../../../lib/secure-fs.js';
+import path from 'path';
+import { getAllowedRootDirectory } from '@automaker/platform';
+import { getErrorMessage, logError } from '../common.js';
 
 export function createDirectoriesHandler() {
   return async (_req: Request, res: Response): Promise<void> => {
     try {
-      const workspaceDir = process.env.WORKSPACE_DIR;
+      const allowedRootDirectory = getAllowedRootDirectory();
 
-      if (!workspaceDir) {
+      if (!allowedRootDirectory) {
         res.status(400).json({
           success: false,
-          error: "WORKSPACE_DIR is not configured",
+          error: 'ALLOWED_ROOT_DIRECTORY is not configured',
         });
         return;
       }
 
+      const resolvedWorkspaceDir = path.resolve(allowedRootDirectory);
+
       // Check if directory exists
       try {
-        await fs.stat(workspaceDir);
+        await secureFs.stat(resolvedWorkspaceDir);
       } catch {
         res.status(400).json({
           success: false,
-          error: "WORKSPACE_DIR path does not exist",
+          error: 'Workspace directory path does not exist',
         });
         return;
       }
 
-      // Add workspace dir to allowed paths
-      addAllowedPath(workspaceDir);
-
       // Read directory contents
-      const entries = await fs.readdir(workspaceDir, { withFileTypes: true });
+      const entries = await secureFs.readdir(resolvedWorkspaceDir, {
+        withFileTypes: true,
+      });
 
       // Filter to directories only and map to result format
       const directories = entries
-        .filter((entry) => entry.isDirectory() && !entry.name.startsWith("."))
+        .filter((entry) => entry.isDirectory() && !entry.name.startsWith('.'))
         .map((entry) => ({
           name: entry.name,
-          path: path.join(workspaceDir, entry.name),
+          path: path.join(resolvedWorkspaceDir, entry.name),
         }))
         .sort((a, b) => a.name.localeCompare(b.name));
 
-      // Add each directory to allowed paths
-      directories.forEach((dir) => addAllowedPath(dir.path));
-
       res.json({
         success: true,
         directories,
       });
     } catch (error) {
-      logError(error, "List workspace directories failed");
+      logError(error, 'List workspace directories failed');
       res.status(500).json({ success: false, error: getErrorMessage(error) });
     }
   };