server.js

import express from 'express';
import cors from 'cors';
import { readdir, readFile, stat } from 'fs/promises';
import { join, resolve, relative, extname } from 'path';
import { fileURLToPath } from 'url';

const __dirname = fileURLToPath(new URL('.', import.meta.url));
const PORT = process.env.DRAFTS_PORT || 3333;
const app = express();
app.use(cors());

const SOURCES = [
  { id: 'drafts', label: 'Drafts', path: resolve(process.env.HOME, 'drafts') },
  { id: 'workspace', label: 'Workspace', path: resolve(process.env.HOME, '.openclaw/workspace') }
];

function safePath(base, rel) {
  const full = resolve(base, rel);
  if (!full.startsWith(base)) throw new Error('Path traversal blocked');
  return full;
}

async function scanDir(dir, base, prefix = '') {
  const entries = [];
  try {
    const items = await readdir(dir, { withFileTypes: true });
    for (const item of items) {
      if (item.name.startsWith('.') || item.name === 'node_modules') continue;
      const rel = prefix ? `${prefix}/${item.name}` : item.name;
      if (item.isDirectory()) {
        const children = await scanDir(join(dir, item.name), base, rel);
        if (children.length > 0) {
          entries.push({ name: item.name, path: rel, type: 'dir', children });
        }
      } else if (extname(item.name) === '.md') {
        entries.push({ name: item.name, path: rel, type: 'file' });
      }
    }
  } catch (e) { /* skip unreadable */ }
  return entries;
}

app.get('/api/sources', (_req, res) => {
  res.json(SOURCES.map(s => ({ id: s.id, label: s.label })));
});

app.get('/api/tree/:sourceId', async (req, res) => {
  const source = SOURCES.find(s => s.id === req.params.sourceId);
  if (!source) return res.status(404).json({ error: 'Source not found' });
  const tree = await scanDir(source.path, source.path);
  res.json(tree);
});

app.get('/api/file/:sourceId/*', async (req, res) => {
  const source = SOURCES.find(s => s.id === req.params.sourceId);
  if (!source) return res.status(404).json({ error: 'Source not found' });
  const relPath = req.params[0];
  try {
    const full = safePath(source.path, relPath);
    const content = await readFile(full, 'utf-8');
    res.json({ content, path: relPath });
  } catch (e) {
    res.status(e.message === 'Path traversal blocked' ? 403 : 404).json({ error: e.message });
  }
});

// Serve built frontend in production
if (process.env.NODE_ENV === 'production') {
  app.use(express.static(join(__dirname, 'dist')));
  app.get('*', (_req, res) => res.sendFile(join(__dirname, 'dist/index.html')));
}

app.listen(PORT, () => console.log(`Drafts viewer running on http://localhost:${PORT}`));