Merge remote-tracking branch 'origin/trunk' into add/persistent-cards-update-notification

# Conflicts:
#	apps/ui/src/components/sidebar-layout/index.tsx

Author: bcotrim

.github/workflows/build-php-cli-binaries.yml

@@ -97,11 +97,11 @@ jobs:
 
     steps:
       - name: Checkout Studio
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Checkout static-php-cli
         if: runner.os == 'macOS' || runner.os == 'Linux'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           repository: crazywhalecc/static-php-cli
           ref: ${{ env.SPC_REF }}
@@ -572,14 +572,14 @@ jobs:
           (Get-FileHash $archive -Algorithm SHA256).Hash.ToLower() | Set-Content -NoNewline "$archive.sha256"
 
       - name: Upload PHP CLI artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: php-${{ env.PHP_VERSION }}-cli-${{ matrix.target }}
           path: out/php-binaries/*
 
       - name: Upload static-php-cli logs
         if: ${{ failure() && (runner.os == 'macOS' || runner.os == 'Linux') }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: spc-logs-${{ matrix.target }}
           path: .cache/static-php-cli/log/*.log
@@ -601,15 +601,15 @@ jobs:
       WPCOM_API_TOKEN: ${{ secrets.WPCOM_API_TOKEN }}
     steps:
       - name: Checkout Studio
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
         with:
           bundler-cache: true
 
       - name: Download PHP CLI artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
         with:
           pattern: php-${{ env.PHP_VERSION }}-cli-*
           path: out/php-binaries

.github/workflows/check-php-cli-versions.yml

@@ -23,10 +23,10 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout Studio
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7
         with:
           node-version-file: '.nvmrc'
 

.github/workflows/gardening.yml

@@ -26,10 +26,10 @@ jobs:
 
     steps:
      - name: Checkout
-       uses: actions/checkout@v7
+       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
      - name: Setup Node
-       uses: actions/setup-node@v7
+       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7
        with:
          node-version-file: '.nvmrc'
 

.github/workflows/stale-pr-notifications.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7
         with:
           node-version-file: '.nvmrc'
 

apps/cli/lib/snapshots.ts

@@ -1,5 +1,4 @@
 import { HOUR_MS, DAY_MS, DEMO_SITE_EXPIRATION_DAYS } from '@studio/common/constants';
-import { Snapshot } from '@studio/common/types/snapshot';
 import { __ } from '@wordpress/i18n';
 import { addDays, addHours, DurationUnit, formatDuration, intervalToDuration } from 'date-fns';
 
@@ -11,11 +10,7 @@ export {
 	pruneExpiredOrphanedSnapshots,
 } from 'cli/lib/cli-config/snapshots';
 
-export function isSnapshotExpired( snapshot: Snapshot ) {
-	const now = new Date();
-	const endDate = addDays( snapshot.date, DEMO_SITE_EXPIRATION_DAYS );
-	return endDate < now;
-}
+export { isSnapshotExpired } from '@studio/common/lib/snapshots';
 
 export function formatDurationUntilExpiry( lastUpdatedAt: number ) {
 	const now = new Date();

apps/local/src/index.ts

@@ -34,10 +34,12 @@ import {
 import {
 	arePathsEqual,
 	isEmptyDir,
+	isPathWithin,
 	isWordPressDirectory,
 	recursiveCopyDirectory,
 } from '@studio/common/lib/fs-utils';
 import { generateNumberedName, generateSiteName } from '@studio/common/lib/generate-site-name';
+import { importIpcEventSchema } from '@studio/common/lib/import-export-events';
 import { isErrnoException } from '@studio/common/lib/is-errno-exception';
 import { getAuthenticationUrl } from '@studio/common/lib/oauth';
 import { decodePassword } from '@studio/common/lib/passwords';
@@ -185,9 +187,7 @@ export async function startLocalServer( options: LocalServerOptions ): Promise<
 	const cliRunner = createCliRunner( { cliBinary, nodeBinary } );
 	const execute = cliRunner.executeCliCommand;
 
-	// --- Server-Sent Events: one stream carries every run's output ------------
-	// The web connector expects the same envelope on both channels: agent run
-	// events on `agent`, session-placement updates on `placement`.
+	// --- Server-Sent Events: one stream carries live UI updates ----------------
 	const sseClients = new Set< Response >();
 	function sseSend( message: { channel: string; payload: unknown } ): void {
 		if ( sseClients.size === 0 ) {
@@ -526,7 +526,15 @@ export async function startLocalServer( options: LocalServerOptions ): Promise<
 
 	api.post( '/paths/compare', ( req: Request, res: Response ) => {
 		const { path1, path2 } = req.body as { path1?: string; path2?: string };
-		res.json( { equal: !! path1 && !! path2 && arePathsEqual( path1, path2 ) } );
+		// Confine both operands to `sitesRoot`: nothing outside it can be a site, and
+		// this keeps untrusted input from reaching statSync (in arePathsEqual).
+		const equal =
+			!! path1 &&
+			!! path2 &&
+			isPathWithin( sitesRoot, path1 ) &&
+			isPathWithin( sitesRoot, path2 ) &&
+			arePathsEqual( path1, path2 );
+		res.json( { equal } );
 	} );
 
 	api.post(
@@ -837,9 +845,8 @@ export async function startLocalServer( options: LocalServerOptions ): Promise<
 		} )
 	);
 
-	// Import a backup archive into an already-created site — the same CLI `import`
-	// the desktop forks. The archive path is normally an upload from `/uploads`,
-	// which is cleaned up afterwards.
+	// Import a backup into an already-created site. Uploaded files are cleaned up
+	// after each attempt, so a retry must upload the selected File again.
 	api.post(
 		'/sites/:id/import',
 		asyncHandler( async ( req: Request, res: Response ) => {
@@ -855,8 +862,18 @@ export async function startLocalServer( options: LocalServerOptions ): Promise<
 			}
 			try {
 				await new Promise< void >( ( resolve, reject ) => {
-					const [ emitter ] = execute( [ 'import', '--path', site.path, archivePath ], {
-						output: 'capture',
+					const [ emitter ] = execute(
+						[ 'import', '--path', site.path, archivePath, '--start-server' ],
+						{ output: 'capture' }
+					);
+					emitter.on( 'data', ( { data } ) => {
+						const parsed = importIpcEventSchema.safeParse( data );
+						if ( parsed.success ) {
+							sseSend( {
+								channel: 'import',
+								payload: { siteId: site.id, event: parsed.data.event },
+							} );
+						}
 					} );
 					emitter.on( 'success', () => resolve() );
 					emitter.on( 'failure', ( { error } ) => reject( error ) );
@@ -867,12 +884,14 @@ export async function startLocalServer( options: LocalServerOptions ): Promise<
 				// direct child of the OS temp dir. Resolve first so `..` in the
 				// supplied path can't escape the temp root and delete elsewhere.
 				const uploadDir = path.dirname( path.resolve( archivePath ) );
-				if ( path.dirname( uploadDir ) === path.resolve( os.tmpdir() ) ) {
+				if (
+					path.dirname( uploadDir ) === path.resolve( os.tmpdir() ) &&
+					path.basename( uploadDir ).startsWith( 'studio-upload-' )
+				) {
 					rm( uploadDir, { recursive: true, force: true }, () => undefined );
 				}
 			}
-			const imported = ( await listSites( execute ) ).find( ( s ) => s.id === req.params.id );
-			res.json( toSiteDetails( imported ?? site ) );
+			res.status( 204 ).end();
 		} )
 	);
 

apps/studio/e2e/page-objects/add-site-modal.ts

@@ -1,5 +1,5 @@
 import { type Page } from '@playwright/test';
-import { ACCEPTED_IMPORT_FILE_TYPES } from '@studio/common/constants';
+import { ACCEPTED_ADD_SITE_FILE_TYPES } from '@studio/common/constants';
 import { type SiteRuntime } from '@studio/common/lib/site-runtime';
 import SiteForm from './site-form';
 
@@ -33,7 +33,7 @@ export default class AddSiteModal {
 	}
 
 	get backupFileInput() {
-		const fileTypes = ACCEPTED_IMPORT_FILE_TYPES.join( ',' );
+		const fileTypes = ACCEPTED_ADD_SITE_FILE_TYPES.join( ',' );
 		return this.page.locator( `input[type="file"][accept="${ fileTypes }"]` );
 	}
 

apps/studio/src/components/add-site-with-blueprint-button.tsx

@@ -1,4 +1,5 @@
 import { ACCEPTED_IMPORT_FILE_TYPES } from '@studio/common/constants';
+import { isSupportedBackupFilename } from '@studio/common/lib/backup-files';
 import { speak } from '@wordpress/a11y';
 import { Notice } from '@wordpress/components';
 import { createInterpolateElement } from '@wordpress/element';
@@ -161,11 +162,7 @@ const InitialImportButton = ( {
 };
 
 const isValidImportFile = ( file: File ): boolean => {
-	const fileName = file.name.toLowerCase();
-	return (
-		ACCEPTED_IMPORT_FILE_TYPES.some( ( ext ) => fileName.endsWith( ext ) ) ||
-		fileName.endsWith( '.sql' )
-	);
+	return isSupportedBackupFilename( file.name );
 };
 
 const ImportSite = ( {
@@ -329,7 +326,7 @@ const ImportSite = ( {
 				className="hidden"
 				type="file"
 				data-testid="backup-file"
-				accept={ `${ ACCEPTED_IMPORT_FILE_TYPES.join( ',' ) },.sql` }
+				accept={ ACCEPTED_IMPORT_FILE_TYPES.join( ',' ) }
 				onChange={ onFileSelected }
 			/>
 		</div>

apps/studio/src/components/content-tab-import-export.tsx

@@ -99,7 +99,7 @@ describe( 'ContentTabImportExport Import', () => {
 		} );
 
 		const dropZone = screen.getByText( /Drag a file here, or click to select a file/i );
-		const file = new File( [ 'file contents' ], 'backup.zip', { type: 'application/zip' } );
+		const file = new File( [ 'file contents' ], 'backup.sql', { type: 'application/sql' } );
 
 		fireEvent.dragEnter( dropZone );
 		fireEvent.dragOver( dropZone );
@@ -120,7 +120,7 @@ describe( 'ContentTabImportExport Import', () => {
 		const fileInput = screen.getByTestId( 'backup-file' );
 		expect( fileInput ).toBeInTheDocument();
 
-		const file = new File( [ 'file contents' ], 'backup.zip', { type: 'application/zip' } );
+		const file = new File( [ 'file contents' ], 'backup.sql', { type: 'application/sql' } );
 
 		await userEvent.upload( fileInput, file );