@aion0/forge 0.5.24 → 0.5.26

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/claude/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server';
+import { createClaudeSession, listProcesses, deleteSession } from '@/lib/claude-process';
+import { getProjectInfo } from '@/lib/projects';
+
+// List all Claude Code sessions
+export async function GET() {
+  return NextResponse.json(listProcesses());
+}
+
+// Create a new Claude Code session for a project
+export async function POST(req: Request) {
+  const { projectName } = await req.json();
+
+  const project = getProjectInfo(projectName);
+  if (!project) {
+    return NextResponse.json({ error: `Project not found: ${projectName}` }, { status: 404 });
+  }
+
+  const session = createClaudeSession(project.name, project.path);
+  return NextResponse.json(session);
+}
+
+// Delete a session
+export async function DELETE(req: Request) {
+  const { id } = await req.json();
+  deleteSession(id);
+  return NextResponse.json({ ok: true });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/claude-sessions/[projectName]/entries/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from 'next/server';
+import { getSessionFilePath, readSessionEntries } from '@/lib/claude-sessions';
+import { statSync } from 'node:fs';
+
+export async function GET(req: Request, { params }: { params: Promise<{ projectName: string }> }) {
+  const { projectName } = await params;
+  const url = new URL(req.url);
+  const sessionId = url.searchParams.get('sessionId');
+
+  if (!sessionId) {
+    return NextResponse.json({ error: 'sessionId required' }, { status: 400 });
+  }
+
+  const filePath = getSessionFilePath(decodeURIComponent(projectName), sessionId);
+  if (!filePath) {
+    return NextResponse.json({ entries: [], count: 0, fileSize: 0 });
+  }
+
+  const entries = readSessionEntries(filePath);
+  let fileSize = 0;
+  try { fileSize = statSync(filePath).size; } catch {}
+  return NextResponse.json({ entries, count: entries.length, fileSize });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/claude-sessions/[projectName]/live/route.ts

@@ -0,0 +1,72 @@
+import { getSessionFilePath, readSessionEntries, tailSessionFile } from '@/lib/claude-sessions';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function GET(req: Request, { params }: { params: Promise<{ projectName: string }> }) {
+  const { projectName } = await params;
+  const url = new URL(req.url);
+  const sessionId = url.searchParams.get('sessionId');
+
+  if (!sessionId) {
+    return new Response('sessionId parameter required', { status: 400 });
+  }
+
+  const filePath = getSessionFilePath(decodeURIComponent(projectName), sessionId);
+  if (!filePath) {
+    return new Response('Session file not found', { status: 404 });
+  }
+
+  const encoder = new TextEncoder();
+  let cleanup: (() => void) | null = null;
+  let heartbeat: ReturnType<typeof setInterval> | null = null;
+  let closed = false;
+
+  const stream = new ReadableStream({
+    start(controller) {
+      // Send all existing entries
+      const existing = readSessionEntries(filePath);
+      controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'init', entries: existing })}\n\n`));
+
+      // Heartbeat
+      heartbeat = setInterval(() => {
+        if (!closed) {
+          try { controller.enqueue(encoder.encode(': heartbeat\n\n')); } catch { doCleanup(); }
+        }
+      }, 15000);
+
+      // Tail for new entries
+      cleanup = tailSessionFile(
+        filePath,
+        (entries) => {
+          if (closed) return;
+          try {
+            controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'update', entries })}\n\n`));
+          } catch { doCleanup(); }
+        },
+        () => {
+          doCleanup();
+          try { controller.close(); } catch {}
+        },
+      );
+    },
+    cancel() {
+      doCleanup();
+    },
+  });
+
+  function doCleanup() {
+    closed = true;
+    if (heartbeat) { clearInterval(heartbeat); heartbeat = null; }
+    if (cleanup) { cleanup(); cleanup = null; }
+  }
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no',
+    },
+  });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/claude-sessions/[projectName]/route.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from 'next/server';
+import { listClaudeSessions, deleteSession } from '@/lib/claude-sessions';
+import { getDb } from '@/src/core/db/database';
+import { getDbPath } from '@/src/config';
+
+export async function GET(_req: Request, { params }: { params: Promise<{ projectName: string }> }) {
+  const { projectName } = await params;
+  const sessions = listClaudeSessions(decodeURIComponent(projectName));
+  return NextResponse.json(sessions);
+}
+
+export async function DELETE(req: Request, { params }: { params: Promise<{ projectName: string }> }) {
+  const { projectName } = await params;
+  const project = decodeURIComponent(projectName);
+  const body = await req.json();
+
+  // Support both single sessionId and batch sessionIds
+  const ids: string[] = body.sessionIds || (body.sessionId ? [body.sessionId] : []);
+
+  if (ids.length === 0) {
+    return NextResponse.json({ error: 'sessionId or sessionIds required' }, { status: 400 });
+  }
+
+  const db = getDb(getDbPath());
+  let deletedCount = 0;
+
+  for (const id of ids) {
+    if (deleteSession(project, id)) {
+      deletedCount++;
+    }
+    try {
+      db.prepare('DELETE FROM cached_sessions WHERE project_name = ? AND session_id = ?').run(project, id);
+    } catch {}
+  }
+
+  return NextResponse.json({ ok: true, deleted: deletedCount });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/claude-sessions/sync/route.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import { ensureInitialized } from '@/lib/init';
+import { syncSessionsToDb, getAllCachedSessions } from '@/lib/session-watcher';
+
+export async function GET() {
+  ensureInitialized();
+  const all = getAllCachedSessions();
+  return NextResponse.json(all);
+}
+
+export async function POST(req: Request) {
+  ensureInitialized();
+  const body = await req.json().catch(() => ({}));
+  const count = syncSessionsToDb(body.projectName);
+  const all = getAllCachedSessions();
+  return NextResponse.json({ synced: count, sessions: all });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/claude-templates/route.ts

@@ -0,0 +1,145 @@
+import { NextResponse } from 'next/server';
+import {
+  listTemplates,
+  getTemplate,
+  saveTemplate,
+  deleteTemplate,
+  isInjected,
+  getInjectedTemplates,
+  injectTemplate,
+  removeTemplate,
+  setTemplateDefault,
+  applyDefaultTemplates,
+} from '@/lib/claude-templates';
+import { loadSettings } from '@/lib/settings';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+function getProjectPaths(): { name: string; path: string }[] {
+  const settings = loadSettings();
+  const roots = (settings.projectRoots || []).map((r: string) => r.replace(/^~/, homedir()));
+  const projects: { name: string; path: string }[] = [];
+  for (const root of roots) {
+    try {
+      const { readdirSync, statSync } = require('node:fs');
+      for (const name of readdirSync(root)) {
+        const p = join(root, name);
+        try { if (statSync(p).isDirectory() && !name.startsWith('.')) projects.push({ name, path: p }); } catch {}
+      }
+    } catch {}
+  }
+  return projects.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// GET /api/claude-templates
+//   ?action=list — list all templates
+//   ?action=status&project=PATH — get injection status for a project
+//   ?action=read-claude-md&project=PATH — read project's CLAUDE.md content
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url);
+  const action = searchParams.get('action') || 'list';
+
+  if (action === 'list') {
+    const templates = listTemplates();
+    const projects = getProjectPaths();
+    return NextResponse.json({ templates, projects });
+  }
+
+  if (action === 'status') {
+    const projectPath = searchParams.get('project');
+    if (!projectPath) return NextResponse.json({ error: 'project required' }, { status: 400 });
+    const claudeMd = join(projectPath, 'CLAUDE.md');
+    const injected = getInjectedTemplates(claudeMd);
+    const templates = listTemplates();
+    const status = templates.map(t => ({
+      id: t.id,
+      name: t.name,
+      injected: injected.includes(t.id),
+    }));
+    return NextResponse.json({ status, hasClaudeMd: existsSync(claudeMd) });
+  }
+
+  if (action === 'read-claude-md') {
+    const projectPath = searchParams.get('project');
+    if (!projectPath) return NextResponse.json({ error: 'project required' }, { status: 400 });
+    const claudeMd = join(projectPath, 'CLAUDE.md');
+    if (!existsSync(claudeMd)) return NextResponse.json({ content: '', exists: false });
+    return NextResponse.json({ content: readFileSync(claudeMd, 'utf-8'), exists: true });
+  }
+
+  return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
+}
+
+// POST /api/claude-templates
+export async function POST(req: Request) {
+  const body = await req.json();
+
+  // Save/create template
+  if (body.action === 'save') {
+    const { id, name, description, tags, content, isDefault } = body;
+    if (!id || !name || !content) return NextResponse.json({ error: 'id, name, content required' }, { status: 400 });
+    saveTemplate(id, name, description || '', tags || [], content, isDefault);
+    return NextResponse.json({ ok: true });
+  }
+
+  // Toggle default flag
+  if (body.action === 'set-default') {
+    const { id, isDefault } = body;
+    if (!id) return NextResponse.json({ error: 'id required' }, { status: 400 });
+    const ok = setTemplateDefault(id, !!isDefault);
+    return NextResponse.json({ ok });
+  }
+
+  // Apply default templates to a project
+  if (body.action === 'apply-defaults') {
+    const { project } = body;
+    if (!project) return NextResponse.json({ error: 'project required' }, { status: 400 });
+    const injected = applyDefaultTemplates(project);
+    return NextResponse.json({ ok: true, injected });
+  }
+
+  // Delete template
+  if (body.action === 'delete') {
+    const ok = deleteTemplate(body.id);
+    if (!ok) return NextResponse.json({ error: 'Cannot delete (builtin or not found)' }, { status: 400 });
+    return NextResponse.json({ ok: true });
+  }
+
+  // Inject template into project(s)
+  if (body.action === 'inject') {
+    const { templateId, projects } = body; // projects: string[] of paths
+    if (!templateId || !projects?.length) return NextResponse.json({ error: 'templateId and projects required' }, { status: 400 });
+    const results: { project: string; injected: boolean; reason?: string }[] = [];
+    for (const projectPath of projects) {
+      const claudeMd = join(projectPath, 'CLAUDE.md');
+      if (isInjected(claudeMd, templateId)) {
+        results.push({ project: projectPath, injected: false, reason: 'already exists' });
+      } else {
+        const ok = injectTemplate(claudeMd, templateId);
+        results.push({ project: projectPath, injected: ok });
+      }
+    }
+    return NextResponse.json({ ok: true, results });
+  }
+
+  // Remove template from project
+  if (body.action === 'remove') {
+    const { templateId, project } = body;
+    if (!templateId || !project) return NextResponse.json({ error: 'templateId and project required' }, { status: 400 });
+    const claudeMd = join(project, 'CLAUDE.md');
+    const ok = removeTemplate(claudeMd, templateId);
+    return NextResponse.json({ ok });
+  }
+
+  // Save CLAUDE.md content directly
+  if (body.action === 'save-claude-md') {
+    const { project, content } = body;
+    if (!project) return NextResponse.json({ error: 'project required' }, { status: 400 });
+    const { writeFileSync: wf } = require('node:fs');
+    wf(join(project, 'CLAUDE.md'), content, 'utf-8');
+    return NextResponse.json({ ok: true });
+  }
+
+  return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
+}

package/.forge/worktrees/pipeline-ecd7cb0f/app/api/code/route.ts

@@ -0,0 +1,299 @@
+import { NextResponse } from 'next/server';
+import { readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join, relative, extname } from 'node:path';
+import { homedir } from 'node:os';
+import { execSync } from 'node:child_process';
+import { loadSettings } from '@/lib/settings';
+
+interface FileNode {
+  name: string;
+  path: string;
+  type: 'file' | 'dir';
+  children?: FileNode[];
+}
+
+const IGNORE = new Set([
+  'node_modules', '.git', '.next', 'dist', 'build', '.idea', '.vscode',
+  '.DS_Store', 'coverage', '__pycache__', '.cache', '.output', 'target',
+]);
+
+const CODE_EXTS = new Set([
+  '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+  '.py', '.go', '.rs', '.java', '.kt', '.swift', '.c', '.cpp', '.h',
+  '.css', '.scss', '.html', '.json', '.yaml', '.yml', '.toml',
+  '.md', '.txt', '.sh', '.bash', '.zsh', '.fish',
+  '.sql', '.graphql', '.proto', '.env', '.gitignore',
+  '.xml', '.csv', '.lock', '.properties', '.gradle', '.groovy',
+  '.scala', '.clj', '.cljs', '.jsp', '.erb', '.vue', '.svelte',
+]);
+
+const IMAGE_EXTS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.svg', '.webp', '.bmp', '.ico', '.avif']);
+
+function isCodeFile(name: string): boolean {
+  if (name.startsWith('.') && !name.startsWith('.env') && !name.startsWith('.git')) return false;
+  const ext = extname(name);
+  if (!ext) return !name.includes('.'); // files like Makefile, Dockerfile
+  return CODE_EXTS.has(ext) || IMAGE_EXTS.has(ext);
+}
+
+function scanDir(dir: string, base: string, depth: number = 0): FileNode[] {
+  if (depth > 10) return [];
+  try {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    const nodes: FileNode[] = [];
+
+    const sorted = entries
+      .filter(e => !IGNORE.has(e.name))
+      .sort((a, b) => {
+        if (a.isDirectory() && !b.isDirectory()) return -1;
+        if (!a.isDirectory() && b.isDirectory()) return 1;
+        return a.name.localeCompare(b.name);
+      });
+
+    for (const entry of sorted) {
+      const fullPath = join(dir, entry.name);
+      const relPath = relative(base, fullPath);
+
+      if (entry.isDirectory()) {
+        const children = scanDir(fullPath, base, depth + 1);
+        nodes.push({ name: entry.name, path: relPath, type: 'dir', children });
+      } else {
+        nodes.push({ name: entry.name, path: relPath, type: 'file' });
+      }
+    }
+    return nodes;
+  } catch {
+    return [];
+  }
+}
+
+// GET /api/code?dir=<absolute-path>&file=<relative-path>
+//   dir mode: returns file tree for the given directory
+//   file mode: returns file content
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url);
+  const dir = searchParams.get('dir');
+  const filePath = searchParams.get('file');
+
+  if (!dir) {
+    return NextResponse.json({ tree: [], dirName: '' });
+  }
+
+  const resolvedDir = dir.replace(/^~/, homedir());
+
+  // Security: dir must be under a projectRoot
+  const settings = loadSettings();
+  const projectRoots = (settings.projectRoots || []).map(r => r.replace(/^~/, homedir()));
+  const allowed = projectRoots.some(root => resolvedDir.startsWith(root) || resolvedDir === root);
+  if (!allowed) {
+    return NextResponse.json({ error: 'Directory not under any project root' }, { status: 403 });
+  }
+
+  // Code search (grep)
+  const searchQuery = searchParams.get('search');
+  if (searchQuery) {
+    try {
+      const { execSync } = require('node:child_process');
+      const safeQuery = searchQuery.replace(/['"\\]/g, '\\$&');
+      // Use grep -rn with limits to prevent huge output
+      let result = '';
+      try {
+        result = execSync(
+          `grep -rn --exclude-dir=node_modules --exclude-dir=.next --exclude-dir=.git --exclude-dir=dist --exclude-dir=build --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' --include='*.py' --include='*.java' --include='*.go' --include='*.rs' --include='*.md' --include='*.json' --include='*.yaml' --include='*.yml' --include='*.css' --include='*.html' --include='*.vue' --include='*.svelte' -m 5 '${safeQuery}' . | head -100`,
+          { cwd: resolvedDir, encoding: 'utf-8', timeout: 10000, stdio: ['pipe', 'pipe', 'pipe'] }
+        ).trim();
+      } catch (e: any) {
+        // grep exit code 1 = no match (not an error)
+        result = e.stdout?.trim() || '';
+      }
+      const matches = result ? result.split('\n').map((line: string) => {
+        const match = line.match(/^\.\/(.+?):(\d+):(.*)$/);
+        if (!match) return null;
+        return { file: match[1], line: parseInt(match[2]), content: match[3].trim().slice(0, 200) };
+      }).filter(Boolean) : [];
+      return NextResponse.json({ matches });
+    } catch {
+      return NextResponse.json({ matches: [] });
+    }
+  }
+
+  // Git diff for a specific file
+  const diffFile = searchParams.get('diff');
+  if (diffFile) {
+    const fullPath = join(resolvedDir, diffFile);
+    if (!fullPath.startsWith(resolvedDir)) {
+      return NextResponse.json({ error: 'Invalid path' }, { status: 400 });
+    }
+    try {
+      // Try staged + unstaged diff
+      let diff = '';
+      try { diff = execSync(`git diff -- "${diffFile}"`, { cwd: resolvedDir, encoding: 'utf-8', timeout: 5000 }); } catch {}
+      if (!diff) {
+        try { diff = execSync(`git diff HEAD -- "${diffFile}"`, { cwd: resolvedDir, encoding: 'utf-8', timeout: 5000 }); } catch {}
+      }
+      if (!diff) {
+        // Untracked file — show entire content as added
+        try {
+          const content = readFileSync(fullPath, 'utf-8');
+          diff = content.split('\n').map(l => `+${l}`).join('\n');
+        } catch {}
+      }
+      return NextResponse.json({ diff: diff || 'No changes' });
+    } catch {
+      return NextResponse.json({ diff: 'Failed to get diff' });
+    }
+  }
+
+  // Read file content
+  if (filePath) {
+    const fullPath = join(resolvedDir, filePath);
+    if (!fullPath.startsWith(resolvedDir)) {
+      return NextResponse.json({ error: 'Invalid path' }, { status: 400 });
+    }
+    try {
+      const stat = statSync(fullPath);
+      const ext = extname(fullPath).replace('.', '').toLowerCase();
+      const size = stat.size;
+      const sizeKB = Math.round(size / 1024);
+      const sizeMB = (size / (1024 * 1024)).toFixed(1);
+
+      // Binary/unsupported file types
+      const BINARY_EXTS = new Set([
+        'png', 'jpg', 'jpeg', 'gif', 'bmp', 'ico', 'webp', 'svg', 'avif',
+        'mp3', 'mp4', 'wav', 'ogg', 'webm', 'mov', 'avi',
+        'zip', 'gz', 'tar', 'bz2', 'xz', '7z', 'rar',
+        'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
+        'exe', 'dll', 'so', 'dylib', 'bin', 'o', 'a',
+        'woff', 'woff2', 'ttf', 'eot', 'otf',
+        'sqlite', 'db', 'sqlite3',
+        'class', 'jar', 'war',
+        'pyc', 'pyo', 'wasm',
+      ]);
+      // Image files — return base64 for preview
+      const IMAGE_PREVIEW = new Set(['png', 'jpg', 'jpeg', 'gif', 'svg', 'webp', 'bmp', 'ico', 'avif']);
+      if (IMAGE_PREVIEW.has(ext)) {
+        if (size > 5_000_000) {
+          return NextResponse.json({ binary: true, fileType: ext, size, sizeLabel: `${sizeMB} MB`, message: 'Image too large to preview (> 5 MB)' });
+        }
+        const data = readFileSync(fullPath);
+        const mime = ext === 'svg' ? 'image/svg+xml' : `image/${ext === 'jpg' ? 'jpeg' : ext}`;
+        const base64 = `data:${mime};base64,${data.toString('base64')}`;
+        return NextResponse.json({ image: true, dataUrl: base64, fileType: ext, size, sizeLabel: sizeKB > 1024 ? `${sizeMB} MB` : `${sizeKB} KB` });
+      }
+      if (BINARY_EXTS.has(ext)) {
+        return NextResponse.json({ binary: true, fileType: ext, size, sizeLabel: sizeKB > 1024 ? `${sizeMB} MB` : `${sizeKB} KB` });
+      }
+
+      const force = searchParams.get('force') === '1';
+
+      // Large file warning (> 200KB needs confirmation, > 2MB blocked)
+      if (size > 2_000_000) {
+        return NextResponse.json({ tooLarge: true, size, sizeLabel: `${sizeMB} MB`, message: 'File exceeds 2 MB limit' });
+      }
+      if (size > 200_000 && !force) {
+        return NextResponse.json({ large: true, size, sizeLabel: `${sizeKB} KB`, language: ext });
+      }
+
+      const content = readFileSync(fullPath, 'utf-8');
+      return NextResponse.json({ content, language: ext, size });
+    } catch {
+      return NextResponse.json({ error: 'File not found' }, { status: 404 });
+    }
+  }
+
+  // Return file tree
+  const tree = scanDir(resolvedDir, resolvedDir);
+  const dirName = resolvedDir.split('/').pop() || resolvedDir;
+
+  // Git status: scan for git repos (could be root dir or subdirectories)
+  interface GitRepo {
+    name: string;       // repo dir name (or '.' for root)
+    branch: string;
+    remote: string;     // remote URL
+    changes: { path: string; status: string }[];
+  }
+  const gitRepos: GitRepo[] = [];
+
+  const gitOpts = { encoding: 'utf-8' as const, timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] as any };
+
+  function scanGitStatus(dir: string, repoName: string, pathPrefix: string) {
+    try {
+      const branch = execSync('git rev-parse --abbrev-ref HEAD', { ...gitOpts, cwd: dir, timeout: 3000 }).toString().trim();
+      const statusOut = execSync('git status --porcelain -u', { ...gitOpts, cwd: dir }).toString();
+      const changes = statusOut.replace(/\n$/, '').split('\n').filter(Boolean)
+        .map(line => {
+          if (line.length < 4) return null;
+          return {
+            status: line.substring(0, 2).trim() || 'M',
+            path: pathPrefix ? `${pathPrefix}/${line.substring(3).replace(/\/$/, '')}` : line.substring(3).replace(/\/$/, ''),
+          };
+        })
+        .filter((g): g is { status: string; path: string } => g !== null && !!g.path && !g.path.includes(' -> '));
+      let remote = '';
+      try { remote = execSync('git remote get-url origin', { ...gitOpts, cwd: dir, timeout: 2000 }).toString().trim(); } catch {}
+      if (branch || changes.length > 0) {
+        gitRepos.push({ name: repoName, branch, remote, changes });
+      }
+    } catch {}
+  }
+
+  // Check if root is a git repo
+  try {
+    execSync('git rev-parse --git-dir', { cwd: resolvedDir, encoding: 'utf-8', timeout: 2000, stdio: ['pipe', 'pipe', 'pipe'] });
+    scanGitStatus(resolvedDir, '.', '');
+  } catch {
+    // Root is not a git repo — scan subdirectories
+    try {
+      for (const entry of readdirSync(resolvedDir, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('.') || IGNORE.has(entry.name)) continue;
+        const subDir = join(resolvedDir, entry.name);
+        try {
+          execSync('git rev-parse --git-dir', { cwd: subDir, encoding: 'utf-8', timeout: 2000, stdio: ['pipe', 'pipe', 'pipe'] });
+          scanGitStatus(subDir, entry.name, entry.name);
+        } catch {}
+      }
+    } catch {}
+  }
+
+  // Flatten for backward compat
+  const gitChanges = gitRepos.flatMap(r => r.changes);
+  const gitBranch = gitRepos.length === 1 ? gitRepos[0].branch : '';
+
+  return NextResponse.json({ tree, dirName, dirPath: resolvedDir, gitBranch, gitChanges, gitRepos });
+}
+
+// PUT /api/code — save file content
+export async function PUT(req: Request) {
+  const { dir, file, content } = await req.json() as {
+    dir: string;
+    file: string;
+    content: string;
+  };
+
+  if (!dir || !file) {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 });
+  }
+
+  const resolvedDir = dir.replace(/^~/, homedir());
+  const fullPath = join(resolvedDir, file);
+
+  // Security: ensure path is within the directory
+  if (!fullPath.startsWith(resolvedDir)) {
+    return NextResponse.json({ error: 'Invalid path' }, { status: 400 });
+  }
+
+  // Verify dir is under a configured project root
+  const settings = loadSettings();
+  const roots = (settings.projectRoots || []).map(r => r.replace(/^~/, homedir()));
+  const allowed = roots.some(r => resolvedDir.startsWith(r));
+  if (!allowed) {
+    return NextResponse.json({ error: 'Directory not in project roots' }, { status: 403 });
+  }
+
+  try {
+    writeFileSync(fullPath, content, 'utf-8');
+    return NextResponse.json({ ok: true });
+  } catch {
+    return NextResponse.json({ error: 'Failed to save' }, { status: 500 });
+  }
+}