File upload/download without git

[nthh]

Summary

Let users transfer files in/out of sandboxes without committing to git. Support drag-and-drop upload in the browser and one-click download.

User stories

• "I want to upload a .env file or dataset into my sandbox"
• "I want to download a generated file (build artifact, CSV, image) from my sandbox"
• "I don't want to commit test data to git just to get it into the sandbox"

Proposed approach: HTTP API + browser UI

API endpoints

POST /api/sessions/{id}/files/upload?path=/home/dev/workspace/
  Body: multipart/form-data (file upload)
  → kubectl exec: write file into pod

GET /api/sessions/{id}/files/download?path=/home/dev/workspace/output.csv
  → kubectl exec: cat file from pod
  Response: file contents with Content-Disposition header

GET /api/sessions/{id}/files/list?path=/home/dev/workspace/
  → kubectl exec: ls -la in pod
  Response: JSON directory listing

Browser UI

• Drag-and-drop zone (overlay on terminal, or dedicated panel)
• Simple file browser panel showing workspace contents
• Download button per file
• Could be a sidebar or modal — feeds into Rich UI overlay: file tree, diff viewer, git widget #13 (rich UI overlay)

Implementation

Server uses kubectl exec (K8s) or docker exec (Docker) to read/write files inside the pod. Works through existing auth — only session owner can access.

For large files, stream via chunked transfer rather than loading entirely into memory.

Alternatives considered

SCP/SFTP (depends on #17)

• More powerful (mount via SSHFS, use FileZilla, etc.)
• But requires SSH infrastructure to ship first
• HTTP API is independent and simpler

WebSocket file channel

• Multiplex file data over existing WS connection
• More complex protocol, marginal benefit over HTTP

Security considerations

• Path traversal: validate and sanitize path parameter (reject .., absolute paths outside /home/dev)
• File size limits: cap uploads (e.g., 100MB) to prevent abuse
• Auth: require session owner authentication (existing cookie/token)

Competitive context

• Shellbox: full scp/SFTP support via SSH
• Sprites: HTTP API for file operations
• GitHub Codespaces: integrated file tree + drag-and-drop