openclacky 1.3.1 → 1.3.3

data/lib/clacky/server/http_server.rb

@@ -16,6 +16,7 @@ require "timeout"
 require "yaml"
 require "date"
 require_relative "session_registry"
+require_relative "git_panel"
 require_relative "web_ui_controller"
 require_relative "scheduler"
 require_relative "../brand_config"
@@ -333,6 +334,14 @@ module Clacky
         server.mount("/api", servlet_class)
         server.mount("/ws",  servlet_class)
 
+        # Health check endpoint — no auth, minimal overhead.
+        # Docker / orchestrators can probe this to decide container health.
+        server.mount_proc("/health") do |_req, res|
+          res.status          = 200
+          res["Content-Type"] = "application/json"
+          res.body            = '{"status":"ok"}'
+        end
+
         # Mount static file handler for the entire web directory.
         # Use mount_proc so we can inject no-cache headers on every response,
         # preventing stale JS/CSS from being served after a gem update.
@@ -347,12 +356,21 @@ module Clacky
         server.mount_proc("/") do |req, res|
           if req.path == "/" || req.path == "/index.html"
             product_name = Clacky::BrandConfig.load.product_name || "OpenClacky"
-            html = File.read(index_html_path).gsub("{{BRAND_NAME}}", product_name)
+            pure         = req.query["pure"] == "true"
+            html = File.read(index_html_path)
+                       .gsub("{{BRAND_NAME}}", product_name)
+                       .gsub("{{EXT_SCRIPTS}}", pure ? "" : self.send(:webui_ext_script_tags))
             res.status                = 200
             res["Content-Type"]       = "text/html; charset=utf-8"
             res["Cache-Control"]      = "no-store"
             res["Pragma"]             = "no-cache"
             res.body                  = html
+          elsif req.path.start_with?("/webui_ext/")
+            self.send(:serve_webui_ext, req, res)
+          elsif req.path.start_with?("/agent_ui/")
+            self.send(:serve_agent_ui, req, res)
+          elsif req.path.start_with?("/panel_ui/")
+            self.send(:serve_panel_ui, req, res)
           else
             file_handler.service(req, res)
             res["Cache-Control"] = "no-store"
@@ -465,6 +483,8 @@ module Clacky
         when ["POST",   "/api/config/test"]   then api_test_config(req, res)
         when ["POST",   "/api/config/media/test"] then api_test_media_config(req, res)
         when ["GET",    "/api/config/media"]  then api_get_media_config(res)
+        when ["GET",    "/api/config/media-output-dir"]   then api_get_media_output_dir(res)
+        when ["PATCH",  "/api/config/media-output-dir"]   then api_update_media_output_dir(req, res)
         when ["GET",    "/api/config/ocr"]    then api_get_ocr_config(res)
         when ["PATCH",  "/api/config/ocr"]    then api_update_ocr_config(req, res)
         when ["POST",   "/api/config/ocr/test"] then api_test_ocr_config(req, res)
@@ -565,6 +585,27 @@ module Clacky
           elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/skills$})
             session_id = path.sub("/api/sessions/", "").sub("/skills", "")
             api_session_skills(session_id, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/git/[a-z]+$})
+            session_id = path[%r{^/api/sessions/([^/]+)/git/}, 1]
+            action     = path[%r{/git/([a-z]+)$}, 1]
+            api_session_git(session_id, action, req, res)
+          elsif method == "POST" && path.match?(%r{^/api/sessions/[^/]+/git/commit$})
+            session_id = path[%r{^/api/sessions/([^/]+)/git/}, 1]
+            api_session_git_commit(session_id, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/time_machine$})
+            session_id = path.sub("/api/sessions/", "").sub("/time_machine", "")
+            api_session_time_machine(session_id, res)
+          elsif method == "POST" && path.match?(%r{^/api/sessions/[^/]+/time_machine/switch$})
+            session_id = path[%r{^/api/sessions/([^/]+)/time_machine/}, 1]
+            api_session_time_machine_switch(session_id, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/time_machine/\d+/diff$})
+            session_id = path[%r{^/api/sessions/([^/]+)/time_machine/}, 1]
+            task_id    = path[%r{/time_machine/(\d+)/diff$}, 1].to_i
+            api_session_time_machine_diff(session_id, task_id, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/time_machine/\d+/restore_preview$})
+            session_id = path[%r{^/api/sessions/([^/]+)/time_machine/}, 1]
+            task_id    = path[%r{/time_machine/(\d+)/restore_preview$}, 1].to_i
+            api_session_time_machine_restore_preview(session_id, task_id, res)
           elsif method == "GET" && path == "/api/dirs"
             api_browse_dirs(req, res)
           elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/files$})
@@ -576,6 +617,9 @@ module Clacky
           elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/messages$})
             session_id = path.sub("/api/sessions/", "").sub("/messages", "")
             api_session_messages(session_id, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+$})
+            session_id = path.sub("/api/sessions/", "")
+            api_get_session(session_id, res)
           elsif method == "PATCH" && path.match?(%r{^/api/sessions/[^/]+$})
             session_id = path.sub("/api/sessions/", "")
             api_rename_session(session_id, req, res)
@@ -630,6 +674,9 @@ module Clacky
           elsif method == "DELETE" && path.match?(%r{^/api/skills/[^/]+$})
             name = URI.decode_www_form_component(path.sub("/api/skills/", ""))
             api_delete_skill(name, res)
+          elsif method == "DELETE" && path.match?(%r{^/api/brand/skills/[^/]+$})
+            slug = URI.decode_www_form_component(path.sub("/api/brand/skills/", ""))
+            api_delete_brand_skill(slug, res)
           elsif method == "POST" && path.match?(%r{^/api/brand/skills/[^/]+/install$})
             slug = URI.decode_www_form_component(path.sub("/api/brand/skills/", "").sub("/install", ""))
             api_brand_skill_install(slug, req, res)
@@ -680,6 +727,16 @@ module Clacky
         json_response(res, 200, { sessions: sessions, has_more: has_more, cron_count: @registry.cron_count })
       end
 
+      # GET /api/sessions/:id — fetch a single session by id (memory + disk merged).
+      # Used by the frontend Router when navigating to a session that isn't in
+      # the paged sidebar list (search results, URL deep links, share links,
+      # browser back/forward, external notifications, etc.).
+      def api_get_session(session_id, res)
+        row = @registry.snapshot(session_id)
+        return json_response(res, 404, { error: "Session not found" }) unless row
+        json_response(res, 200, { session: row })
+      end
+
       def api_create_session(req, res)
         body = parse_json_body(req)
         name = body["name"]
@@ -946,9 +1003,195 @@ module Clacky
         @agent_config.save
       end
 
+      # Absolute path to the user's WebUI extension directory.
+      WEBUI_EXT_ROOT = File.expand_path("~/.clacky/webui_ext")
+
+      # Build the full <script> payload injected at {{EXT_SCRIPTS}}:
+      #   1. global extensions   — ~/.clacky/webui_ext/**/*.js  (all agents)
+      #   2. agent-scoped UI     — agents/<name>/webui/**/*.js   (data-agent)
+      #   3. official panels     — default_agents/_panels/<id>/**/*.js (data-panel)
+      # Prefixed with a registerPanelAgents() call so the client knows which
+      # agent profiles reference each official panel. Never raises.
+      private def webui_ext_script_tags
+        [
+          panel_agents_script,
+          global_ext_script_tags,
+          agent_webui_script_tags,
+          official_panel_script_tags,
+        ].reject(&:empty?).join("\n")
+      end
+
+      # Inline script registering the panel→agents map (which agent profiles
+      # reference each official panel, from their profile.yml `panels:`).
+      private def panel_agents_script
+        map = panel_agents_map
+        return "" if map.empty?
+
+        "<script>Clacky.ext.registerPanelAgents(#{map.to_json})</script>"
+      end
+
+      # { "git" => ["coding", ...], ... } — scan every agent profile.yml for a
+      # `panels:` list and invert it into panel → referencing agents.
+      private def panel_agents_map
+        result = Hash.new { |h, k| h[k] = [] }
+        agent_profile_dirs.each do |name, dir|
+          yml = File.join(dir, "profile.yml")
+          next unless File.file?(yml)
+
+          data = begin
+            YAML.safe_load(File.read(yml)) || {}
+          rescue StandardError
+            {}
+          end
+          Array(data["panels"]).each { |panel| result[panel.to_s] << name unless result[panel.to_s].include?(name) }
+        end
+        result
+      end
+
+      # { agent_name => resolved_dir } across built-in and user agent dirs,
+      # user dir winning on name collision (matches AgentProfile lookup order).
+      private def agent_profile_dirs
+        dirs = {}
+        [Clacky::AgentProfile::DEFAULT_AGENTS_DIR, Clacky::AgentProfile::USER_AGENTS_DIR].each do |root|
+          next unless Dir.exist?(root)
+
+          Dir.children(root).each do |name|
+            next if name.start_with?("_") # _panels and other non-agent dirs
+            full = File.join(root, name)
+            next unless File.directory?(full) && File.file?(File.join(full, "profile.yml"))
+
+            dirs[name] = full
+          end
+        end
+        dirs
+      end
+
+      # Global extensions — visible for all agents (unchanged legacy behavior).
+      private def global_ext_script_tags
+        ext_script_block(WEBUI_EXT_ROOT, "/webui_ext")
+      end
+
+      # Agent-scoped UI: agents/<name>/webui/**/*.js. Each script is tagged with
+      # its owning agent so the client only mounts it for that profile.
+      private def agent_webui_script_tags
+        agent_profile_dirs.filter_map do |name, dir|
+          webui = File.join(dir, "webui")
+          next unless Dir.exist?(webui)
+
+          ext_script_block(webui, "/agent_ui/#{name}", id_prefix: "agent/#{name}/", agents: [name])
+        end.reject(&:empty?).join("\n")
+      end
+
+      # Official panels: default_agents/_panels/<id>/**/*.js. Scope comes from
+      # the panel→agents map (registerPanelAgents), so a panel only mounts for
+      # agents whose profile.yml references it.
+      private def official_panel_script_tags
+        root = File.join(Clacky::AgentProfile::DEFAULT_AGENTS_DIR, "_panels")
+        return "" unless Dir.exist?(root)
+
+        Dir.children(root).sort.filter_map do |panel|
+          dir = File.join(root, panel)
+          next unless File.directory?(dir)
+
+          ext_script_block(dir, "/panel_ui/#{panel}", id_prefix: "panel/#{panel}/", panel: panel)
+        end.reject(&:empty?).join("\n")
+      end
+
+      # Emit begin/script/end triples for every *.js under `root`, served from
+      # `url_base`. `agents`/`panel` carry agent-scoping to _extBegin so the
+      # client can decide visibility. Returns "" when the dir is absent.
+      private def ext_script_block(root, url_base, id_prefix: "", agents: nil, panel: nil)
+        return "" unless Dir.exist?(root)
+
+        Dir.glob(File.join(root, "**", "*.js")).sort.map do |abs|
+          rel    = abs.delete_prefix(root + "/")
+          ext_id = id_prefix + rel.delete_suffix(".js")
+          src    = "#{url_base}/#{rel}"
+          # Bracket the extension's own <script> with begin/end markers so that
+          # registrations made during its synchronous evaluation are attributed
+          # to it (for crash attribution / disable). Synchronous src scripts run
+          # in document order, so the surrounding inline scripts run immediately
+          # before and after it.
+          "<script>Clacky.ext._extBegin(#{ext_id.to_json}, #{agents.to_json}, #{panel.to_json})</script>" \
+            "<script src=#{src.to_json} data-ext-id=#{ext_id.to_json}></script>" \
+            "<script>Clacky.ext._extEnd()</script>"
+        end.join("\n")
+      end
+
+      # Serve a static file from ~/.clacky/webui_ext/. Read-only, JS/CSS/HTML only,
+      # with strict path containment so a crafted path cannot escape the dir.
+      private def serve_webui_ext(req, res)
+        rel = req.path.delete_prefix("/webui_ext/")
+        abs = File.expand_path(File.join(WEBUI_EXT_ROOT, rel))
+
+        unless abs.start_with?(WEBUI_EXT_ROOT + File::SEPARATOR) && File.file?(abs)
+          res.status = 404
+          res.body   = "not found"
+          return
+        end
+
+        ext = File.extname(abs)
+        ctype = { ".js" => "application/javascript", ".css" => "text/css",
+                  ".html" => "text/html; charset=utf-8" }[ext]
+        unless ctype
+          res.status = 415
+          res.body   = "unsupported media type"
+          return
+        end
+
+        res.status           = 200
+        res["Content-Type"]  = ctype
+        res["Cache-Control"] = "no-store"
+        res["Pragma"]        = "no-cache"
+        res.body             = File.read(abs)
+      end
+
+      # Serve agents/<name>/webui/<file> from built-in or user agent dir.
+      # Path: /agent_ui/<name>/<rel>. User dir wins on name collision.
+      private def serve_agent_ui(req, res)
+        rest = req.path.delete_prefix("/agent_ui/")
+        name, _, rel = rest.partition("/")
+        dir = agent_profile_dirs[name]
+        return (res.status = 404; res.body = "not found") unless dir && !rel.empty?
 
-      # GET /api/browser/status
-      # Returns real daemon liveness from BrowserManager (not just yml read).
+        serve_static_under(File.join(dir, "webui"), rel, res)
+      end
+
+      # Serve official panel assets: /panel_ui/<panel>/<rel>.
+      private def serve_panel_ui(req, res)
+        rest = req.path.delete_prefix("/panel_ui/")
+        panel, _, rel = rest.partition("/")
+        return (res.status = 404; res.body = "not found") if panel.empty? || rel.empty?
+
+        root = File.join(Clacky::AgentProfile::DEFAULT_AGENTS_DIR, "_panels", panel)
+        serve_static_under(root, rel, res)
+      end
+
+      # Read-only static serve of `rel` under `root`, JS/CSS/HTML only, with
+      # strict path containment so a crafted rel cannot escape `root`.
+      private def serve_static_under(root, rel, res)
+        root = File.expand_path(root)
+        abs  = File.expand_path(File.join(root, rel))
+        unless abs.start_with?(root + File::SEPARATOR) && File.file?(abs)
+          res.status = 404
+          res.body   = "not found"
+          return
+        end
+
+        ctype = { ".js" => "application/javascript", ".css" => "text/css",
+                  ".html" => "text/html; charset=utf-8" }[File.extname(abs)]
+        unless ctype
+          res.status = 415
+          res.body   = "unsupported media type"
+          return
+        end
+
+        res.status           = 200
+        res["Content-Type"]  = ctype
+        res["Cache-Control"] = "no-store"
+        res["Pragma"]        = "no-cache"
+        res.body             = File.read(abs)
+      end
       def api_browser_status(res)
         json_response(res, 200, @browser_manager.status)
       end
@@ -1057,13 +1300,18 @@ module Clacky
 
         aspect_ratio = body["aspect_ratio"].to_s
         aspect_ratio = "landscape" if aspect_ratio.empty?
-        output_dir   = body["output_dir"].to_s
-        output_dir   = @agent_config.default_working_dir || Dir.pwd if output_dir.empty?
+        output_dir   = Clacky::Media::OutputDir.resolve(
+          param:      body["output_dir"],
+          configured: @agent_config.media_output_dir,
+          fallback:   @agent_config.default_working_dir || Dir.pwd
+        )
 
         result = Clacky::Media::Generator.new(@agent_config).generate_image(
           prompt: prompt,
           aspect_ratio: aspect_ratio,
-          output_dir: output_dir
+          output_dir: output_dir,
+          image: body["image"],
+          images: body["images"]
         )
         if result["success"]
           log_media_usage(result, prompt: prompt)
@@ -1087,8 +1335,11 @@ module Clacky
         aspect_ratio = "landscape" if aspect_ratio.empty?
         duration     = body["duration_seconds"]
         image        = body["image"]
-        output_dir   = body["output_dir"].to_s
-        output_dir   = @agent_config.default_working_dir || Dir.pwd if output_dir.empty?
+        output_dir   = Clacky::Media::OutputDir.resolve(
+          param:      body["output_dir"],
+          configured: @agent_config.media_output_dir,
+          fallback:   @agent_config.default_working_dir || Dir.pwd
+        )
 
         result = Clacky::Media::Generator.new(@agent_config).generate_video(
           prompt: prompt,
@@ -1116,8 +1367,11 @@ module Clacky
         end
 
         voice      = body["voice"]
-        output_dir = body["output_dir"].to_s
-        output_dir = @agent_config.default_working_dir || Dir.pwd if output_dir.empty?
+        output_dir = Clacky::Media::OutputDir.resolve(
+          param:      body["output_dir"],
+          configured: @agent_config.media_output_dir,
+          fallback:   @agent_config.default_working_dir || Dir.pwd
+        )
 
         result = Clacky::Media::Generator.new(@agent_config).generate_speech(
           input: input,
@@ -1942,6 +2196,23 @@ module Clacky
         json_response(res, 500, { ok: false, error: e.message })
       end
 
+      # DELETE /api/brand/skills/:slug
+      # Uninstalls a brand skill by removing its files and metadata.
+      def api_delete_brand_skill(slug, res)
+        brand = Clacky::BrandConfig.load
+        installed = brand.installed_brand_skills
+        unless installed.key?(slug)
+          json_response(res, 404, { ok: false, error: "Brand skill '#{slug}' is not installed" })
+          return
+        end
+
+        brand.delete_brand_skill!(slug)
+        @skill_loader = Clacky::SkillLoader.new(working_dir: nil, brand_config: brand)
+        json_response(res, 200, { ok: true })
+      rescue StandardError => e
+        json_response(res, 500, { ok: false, error: e.message })
+      end
+
       # GET /api/brand
       # Returns brand metadata consumed by the WebUI on boot
       # to dynamically replace branding strings.
@@ -2895,10 +3166,13 @@ module Clacky
           result = Utils::EnvironmentDetector.open_file(linux_path)
           return json_response(res, 501, { error: "unsupported OS" }) if result.nil?
           json_response(res, 200, { ok: true })
+        when "reveal"
+          Utils::EnvironmentDetector.reveal_file(linux_path)
+          json_response(res, 200, { ok: true })
         when "download"
           serve_file_download(res, linux_path)
         else
-          json_response(res, 400, { error: "invalid action. Must be 'open' or 'download'" })
+          json_response(res, 400, { error: "invalid action. Must be 'open', 'reveal' or 'download'" })
         end
       rescue => e
         json_response(res, 500, { ok: false, error: e.message })
@@ -3346,7 +3620,147 @@ module Clacky
         json_response(res, 200, { skills: skill_data })
       end
 
-      # GET /api/sessions/:id/files?path=<relative dir>
+      # GET /api/sessions/:id/git/<action> — read-only git info for the session's
+      # working_dir. action ∈ status|diff|log|branches. diff accepts ?file=,
+      # log accepts ?limit=.
+      def api_session_git(session_id, action, req, res)
+        dir = git_session_dir(session_id, res)
+        return unless dir
+
+        unless Clacky::Server::GitPanel.repo?(dir)
+          return json_response(res, 200, { repo: false })
+        end
+
+        query = URI.decode_www_form(req.query_string.to_s).to_h
+        case action
+        when "status"
+          json_response(res, 200, { repo: true }.merge(Clacky::Server::GitPanel.status(dir)))
+        when "diff"
+          json_response(res, 200, { repo: true, diff: Clacky::Server::GitPanel.diff(dir, file: query["file"]) })
+        when "log"
+          json_response(res, 200, { repo: true, commits: Clacky::Server::GitPanel.log(dir, limit: query["limit"] || 50) })
+        when "branches"
+          json_response(res, 200, { repo: true, branches: Clacky::Server::GitPanel.branches(dir) })
+        else
+          json_response(res, 404, { error: "Unknown git action" })
+        end
+      end
+
+      # POST /api/sessions/:id/git/commit — body: { message:, files: [..] }.
+      def api_session_git_commit(session_id, req, res)
+        dir = git_session_dir(session_id, res)
+        return unless dir
+
+        unless Clacky::Server::GitPanel.repo?(dir)
+          return json_response(res, 400, { error: "Not a git repository" })
+        end
+
+        body = parse_json_body(req)
+        result = Clacky::Server::GitPanel.commit(dir, message: body["message"], files: body["files"])
+        if result[:ok]
+          json_response(res, 200, result)
+        else
+          json_response(res, 422, { error: result[:error] })
+        end
+      end
+
+      # GET /api/sessions/:id/time_machine — task history for the Time Machine
+      # panel. Mirrors the CLI menu: each entry carries id, summary, status
+      # (current/past/undone) and whether it branches.
+      def api_session_time_machine(session_id, res)
+        agent = time_machine_agent(session_id, res)
+        return unless agent
+
+        history = agent.get_task_history(limit: 20)
+        json_response(res, 200, { tasks: history })
+      end
+
+      # POST /api/sessions/:id/time_machine/switch — body: { task_id: }.
+      # Restores the working tree to the end-of-task state of task_id.
+      def api_session_time_machine_switch(session_id, req, res)
+        agent = time_machine_agent(session_id, res)
+        return unless agent
+
+        body = parse_json_body(req)
+        task_id = body["task_id"].to_i
+        result = agent.switch_to_task(task_id)
+        if result[:success]
+          @session_manager.save(agent.to_session_data(status: :success))
+          broadcast_session_update(session_id)
+          json_response(res, 200, { ok: true, message: result[:message], task_id: result[:task_id] })
+        else
+          json_response(res, 422, { ok: false, error: result[:message] })
+        end
+      end
+
+      # GET /api/sessions/:id/time_machine/:task_id/diff
+      # Without ?path: returns the file list this task touched.
+      # With ?path=<rel>: returns the unified diff of that file.
+      def api_session_time_machine_diff(session_id, task_id, req, res)
+        agent = time_machine_agent(session_id, res)
+        return unless agent
+
+        rel = req.query["path"].to_s
+        if rel.empty?
+          json_response(res, 200, { ok: true, task_id: task_id, files: agent.task_diff_files(task_id) })
+        else
+          diff = agent.task_file_diff(task_id, rel)
+          if diff.nil?
+            json_response(res, 404, { ok: false, error: "No diff for #{rel}" })
+          else
+            json_response(res, 200, { ok: true, task_id: task_id }.merge(diff))
+          end
+        end
+      end
+
+      # GET /api/sessions/:id/time_machine/:task_id/restore_preview
+      # Returns the file-level effect of switching back to this task without
+      # actually performing the switch. Lets the UI render an honest
+      # confirmation listing the files that would be overwritten/created/deleted.
+      def api_session_time_machine_restore_preview(session_id, task_id, res)
+        agent = time_machine_agent(session_id, res)
+        return unless agent
+
+        changes = agent.preview_restore_to_task(task_id)
+        json_response(res, 200, { ok: true, task_id: task_id, changes: changes })
+      end
+
+      # Resolve a session's agent for time-machine ops; writes the error
+      # response and returns nil on failure.
+      private def time_machine_agent(session_id, res)
+        unless @registry.ensure(session_id)
+          json_response(res, 404, { error: "Session not found" })
+          return nil
+        end
+        session = @registry.get(session_id)
+        agent   = session && session[:agent]
+        unless agent
+          json_response(res, 404, { error: "Session not found" })
+          return nil
+        end
+        agent
+      end
+
+      # Resolve a session's working_dir for git ops; writes the error response
+      # and returns nil on any failure.
+      private def git_session_dir(session_id, res)
+        unless @registry.ensure(session_id)
+          json_response(res, 404, { error: "Session not found" })
+          return nil
+        end
+        session = @registry.get(session_id)
+        agent   = session && session[:agent]
+        unless agent
+          json_response(res, 404, { error: "Session not found" })
+          return nil
+        end
+        dir = File.expand_path(agent.working_dir.to_s)
+        unless Dir.exist?(dir)
+          json_response(res, 404, { error: "Working directory not found" })
+          return nil
+        end
+        dir
+      end
       # Lists one directory level inside the session's working_dir (lazy, per-layer).
       # Path traversal outside working_dir is rejected. Noisy dirs are hidden.
       IGNORED_FILE_ENTRIES = %w[.git .svn .hg node_modules .DS_Store .bundle vendor/bundle tmp .sass-cache].freeze
@@ -4324,7 +4738,83 @@ module Clacky
         json_response(res, 422, { error: e.message })
       end
 
-      # POST /api/config — save updated model list
+      # GET /api/config/media-output-dir
+      # Returns the user-configured directory under which generated media
+      # files (images / videos / audio) are persisted, plus the default
+      # the system would use if the value is empty. The frontend uses
+      # `default` as a placeholder hint.
+      def api_get_media_output_dir(res)
+        json_response(res, 200, {
+          ok:      true,
+          value:   @agent_config.media_output_dir.to_s,
+          default: default_media_output_dir
+        })
+      end
+
+      # PATCH /api/config/media-output-dir
+      # Body: { "value": "<absolute or ~-prefixed path, or empty to clear>" }
+      # Empty / blank value clears the override, restoring the legacy
+      # fallback (default_working_dir → Dir.pwd) for new generations.
+      def api_update_media_output_dir(req, res)
+        body = parse_json_body(req)
+        return json_response(res, 400, { error: "Invalid JSON" }) unless body
+
+        raw = body["value"].to_s.strip
+        if raw.empty?
+          @agent_config.media_output_dir = nil
+          @agent_config.save
+          return json_response(res, 200, {
+            ok:      true,
+            value:   "",
+            default: default_media_output_dir
+          })
+        end
+
+        expanded = File.expand_path(raw)
+
+        # Reject anything that's not an absolute path after `~` expansion.
+        # Relative paths would silently resolve against the server's CWD,
+        # which is exactly the source of confusion this setting exists to fix.
+        unless expanded.start_with?("/")
+          return json_response(res, 422, {
+            error: "media_output_dir must be an absolute path or start with ~"
+          })
+        end
+
+        # Create the directory if missing; surface filesystem errors plainly
+        # so the user can fix permissions / typo without reading server logs.
+        begin
+          FileUtils.mkdir_p(expanded)
+        rescue Errno::EACCES, Errno::EROFS, Errno::ENOSPC, Errno::ENOTDIR => e
+          return json_response(res, 422, {
+            error: "cannot create directory: #{e.message}"
+          })
+        end
+
+        unless File.writable?(expanded)
+          return json_response(res, 422, {
+            error: "directory is not writable: #{expanded}"
+          })
+        end
+
+        @agent_config.media_output_dir = expanded
+        @agent_config.save
+        json_response(res, 200, {
+          ok:      true,
+          value:   expanded,
+          default: default_media_output_dir
+        })
+      rescue => e
+        json_response(res, 422, { error: e.message })
+      end
+
+      # The path the resolver would pick if media_output_dir is blank.
+      # Mirrors the fallback chain inside Clacky::Media::OutputDir.resolve so
+      # the frontend can render it as a placeholder hint (no second source
+      # of truth — both call sites read default_working_dir).
+      private def default_media_output_dir
+        @agent_config.default_working_dir.to_s.empty? ? Dir.pwd : @agent_config.default_working_dir
+      end
       # DEPRECATED: this endpoint previously accepted the entire models array
       # and replaced @models in place. That design was fragile — any missing
       # or stale field on ANY row could wipe other rows' api_keys. It has
@@ -5062,6 +5552,10 @@ module Clacky
             conn.send_json(type: "error", message: "Session not found: #{session_id}")
           end
 
+        when "edit_message"
+          session_id = msg["session_id"] || conn.session_id
+          handle_edit_message(session_id, msg["content"].to_s, msg["created_at"].to_s)
+
         when "message"
           session_id = msg["session_id"] || conn.session_id
           # Merge legacy images array into files as { data_url:, name:, mime_type: } entries
@@ -5112,6 +5606,20 @@ module Clacky
 
       # ── Session actions ───────────────────────────────────────────────────────
 
+      def handle_edit_message(session_id, content, created_at)
+        return unless @registry.exist?(session_id)
+
+        agent = nil
+        @registry.with_session(session_id) { |s| agent = s[:agent] }
+        return unless agent
+
+        if agent.history.respond_to?(:truncate_from_created_at) && !created_at.to_s.empty?
+          agent.history.truncate_from_created_at(created_at)
+        end
+
+        handle_user_message(session_id, content)
+      end
+
       def handle_user_message(session_id, content, files = [])
         return unless @registry.exist?(session_id)