@axhub/genie 0.2.7 → 0.2.9

package/server/routes/cli-auth.js

@@ -1,9 +1,9 @@
 import express from 'express';
-import { constants as fsConstants } from 'fs';
 import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
 import { listOpencodeModels } from '../opencode-cli.js';
+import { resolveCommandPath } from '../utils/resolveCommandPath.js';
 
 const router = express.Router();
 const INSTALLATION_CACHE_TTL_MS = 12 * 60 * 60 * 1000;
@@ -22,78 +22,6 @@ const PROVIDER_INSTALL_HINTS = {
 const installationStatusCache = new Map(); // provider -> status
 const installationStatusInFlight = new Map(); // provider -> Promise
 
-function getLocatorCommand() {
-  return process.platform === 'win32' ? 'where' : 'which';
-}
-
-async function isRunnableCommand(candidatePath) {
-  try {
-    if (process.platform === 'win32') {
-      await fs.access(candidatePath, fsConstants.F_OK);
-      return true;
-    }
-
-    await fs.access(candidatePath, fsConstants.X_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function resolveCommandPath(command) {
-  const normalizedCommand = String(command || '').trim();
-  if (!normalizedCommand) {
-    return {
-      found: false,
-      resolvedPath: null,
-      reason: 'Command name is empty'
-    };
-  }
-
-  const isDirectPath = normalizedCommand.includes(path.sep) || (process.platform === 'win32' && normalizedCommand.includes('/'));
-  const pathEntries = isDirectPath
-    ? ['']
-    : String(process.env.PATH || '')
-      .split(path.delimiter)
-      .map((entry) => entry.trim())
-      .filter(Boolean);
-
-  const windowsExtensions = process.platform === 'win32'
-    ? String(process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM')
-      .split(';')
-      .map((ext) => ext.trim())
-      .filter(Boolean)
-    : [''];
-
-  const candidatePaths = [];
-  for (const baseDir of pathEntries) {
-    const baseCandidate = isDirectPath ? normalizedCommand : path.join(baseDir, normalizedCommand);
-    candidatePaths.push(baseCandidate);
-
-    if (process.platform === 'win32' && !path.extname(baseCandidate)) {
-      for (const ext of windowsExtensions) {
-        candidatePaths.push(`${baseCandidate}${ext}`);
-      }
-    }
-  }
-
-  for (const candidatePath of candidatePaths) {
-    if (await isRunnableCommand(candidatePath)) {
-      return {
-        found: true,
-        resolvedPath: candidatePath,
-        reason: null
-      };
-    }
-  }
-
-  return {
-    found: false,
-    resolvedPath: null,
-    reason: `${normalizedCommand} not found in PATH`
-  };
-}
-
 function buildInstallationStatus(provider, command, installed, resolvedPath, reason, cacheHit = false) {
   return {
     success: true,

package/server/routes/commands.js

@@ -199,13 +199,8 @@ Custom commands can be created in:
     }, {});
 
     const currentProvider = context?.provider || 'claude';
-    const providerDefaults = {
-      claude: CLAUDE_MODELS.DEFAULT,
-      codex: CODEX_MODELS.DEFAULT,
-      gemini: GEMINI_MODELS.DEFAULT,
-      opencode: OPENCODE_MODELS.DEFAULT
-    };
-    const currentModel = context?.model || providerDefaults[currentProvider] || CLAUDE_MODELS.DEFAULT;
+    const discoveredCurrentModel = providerDiscovery.find((item) => item.provider === currentProvider)?.currentModel || null;
+    const currentModel = context?.model || discoveredCurrentModel || null;
     const opencodeDiscovery = providerDiscovery.find((item) => item.provider === 'opencode') || null;
 
     return {
@@ -220,7 +215,7 @@ Custom commands can be created in:
         opencodeDiscovery,
         message: args.length > 0
           ? `Switching to model: ${args[0]}`
-          : `Current model: ${currentModel}`
+          : (currentModel ? `Current model: ${currentModel}` : 'Current model is managed by the active provider configuration.')
       }
     };
   },
@@ -254,7 +249,7 @@ Custom commands can be created in:
         packageName,
         uptime: uptimeFormatted,
         uptimeSeconds: Math.floor(uptime),
-        model: context?.model || 'claude-sonnet-4.5',
+        model: context?.model || null,
         provider: context?.provider || 'claude',
         nodeVersion: process.version,
         platform: process.platform

package/server/routes/projects.js

@@ -1,13 +1,23 @@
 import express from 'express';
 import { promises as fs } from 'fs';
 import path from 'path';
-import os from 'os';
 import { addProjectManually } from '../projects.js';
+import {
+  DEFAULT_WORKSPACES_ROOT,
+  HAS_WORKSPACES_ROOT_RESTRICTION,
+  WORKSPACES_ROOTS,
+  formatAllowedWorkspaceRoots,
+  isPathWithinAllowedRoots,
+  resolveAllowedWorkspaceRoots
+} from '../utils/workspaceRoots.js';
 
-const router = express.Router();
+export {
+  DEFAULT_WORKSPACES_ROOT,
+  HAS_WORKSPACES_ROOT_RESTRICTION,
+  WORKSPACES_ROOTS
+} from '../utils/workspaceRoots.js';
 
-// Configure allowed workspace root (defaults to user's home directory)
-export const WORKSPACES_ROOT = process.env.WORKSPACES_ROOT || os.homedir();
+const router = express.Router();
 
 // System-critical paths that should never be used as workspace directories
 export const FORBIDDEN_PATHS = [
@@ -42,8 +52,14 @@ export const FORBIDDEN_PATHS = [
  * @param {string} requestedPath - The path to validate
  * @returns {Promise<{valid: boolean, resolvedPath?: string, error?: string}>}
  */
-export async function validateWorkspacePath(requestedPath) {
+export async function validateWorkspacePath(requestedPath, options = {}) {
   try {
+    const {
+      fsImpl = fs,
+      hasWorkspaceRootRestriction = HAS_WORKSPACES_ROOT_RESTRICTION,
+      allowedWorkspaceRoots = WORKSPACES_ROOTS
+    } = options;
+
     // Resolve to absolute path
     let absolutePath = path.resolve(requestedPath);
 
@@ -79,14 +95,14 @@ export async function validateWorkspacePath(requestedPath) {
     let realPath;
     try {
       // Check if path exists to resolve real path
-      await fs.access(absolutePath);
-      realPath = await fs.realpath(absolutePath);
+      await fsImpl.access(absolutePath);
+      realPath = await fsImpl.realpath(absolutePath);
     } catch (error) {
       if (error.code === 'ENOENT') {
         // Path doesn't exist yet - check parent directory
         let parentPath = path.dirname(absolutePath);
         try {
-          const parentRealPath = await fs.realpath(parentPath);
+          const parentRealPath = await fsImpl.realpath(parentPath);
 
           // Reconstruct the full path with real parent
           realPath = path.join(parentRealPath, path.basename(absolutePath));
@@ -104,31 +120,36 @@ export async function validateWorkspacePath(requestedPath) {
       }
     }
 
-    // Resolve the workspace root to its real path
-    const resolvedWorkspaceRoot = await fs.realpath(WORKSPACES_ROOT);
+    if (hasWorkspaceRootRestriction && allowedWorkspaceRoots.length > 0) {
+      const resolvedWorkspaceRoots = await resolveAllowedWorkspaceRoots({
+        fsImpl,
+        allowedWorkspaceRoots
+      });
 
-    // Ensure the resolved path is contained within the allowed workspace root
-    if (!realPath.startsWith(resolvedWorkspaceRoot + path.sep) &&
-        realPath !== resolvedWorkspaceRoot) {
-      return {
-        valid: false,
-        error: `Workspace path must be within the allowed workspace root: ${WORKSPACES_ROOT}`
-      };
+      if (!isPathWithinAllowedRoots(realPath, resolvedWorkspaceRoots)) {
+        return {
+          valid: false,
+          error: `Workspace path must be within one of the allowed workspace roots: ${formatAllowedWorkspaceRoots(allowedWorkspaceRoots)}`
+        };
+      }
     }
 
     // Additional symlink check for existing paths
     try {
-      await fs.access(absolutePath);
-      const stats = await fs.lstat(absolutePath);
+      await fsImpl.access(absolutePath);
+      const stats = await fsImpl.lstat(absolutePath);
 
-      if (stats.isSymbolicLink()) {
+      if (stats.isSymbolicLink() && hasWorkspaceRootRestriction && allowedWorkspaceRoots.length > 0) {
+        const resolvedWorkspaceRoots = await resolveAllowedWorkspaceRoots({
+          fsImpl,
+          allowedWorkspaceRoots
+        });
         // Verify symlink target is also within allowed root
-        const linkTarget = await fs.readlink(absolutePath);
+        const linkTarget = await fsImpl.readlink(absolutePath);
         const resolvedTarget = path.resolve(path.dirname(absolutePath), linkTarget);
-        const realTarget = await fs.realpath(resolvedTarget);
+        const realTarget = await fsImpl.realpath(resolvedTarget);
 
-        if (!realTarget.startsWith(resolvedWorkspaceRoot + path.sep) &&
-            realTarget !== resolvedWorkspaceRoot) {
+        if (!isPathWithinAllowedRoots(realTarget, resolvedWorkspaceRoots)) {
           return {
             valid: false,
             error: 'Symlink target is outside the allowed workspace root'

package/server/routes/session-core.js

@@ -1,8 +1,17 @@
 import express from 'express';
-import { getProjects } from '../projects.js';
+import crypto from 'node:crypto';
+import path from 'path';
+import {
+  getClaudeSessionMetadata,
+  getCodexSessionMetadata,
+  getGeminiSessionMetadata,
+  getOpencodeSessionMetadata,
+  getProjects,
+  getProjectsList
+} from '../projects.js';
 import { discoverAllProviders, discoverProvider } from '../session-core/providerDiscovery.js';
 import { getProviderAdapter } from '../session-core/providerAdapters.js';
-import { listAcpSessions } from '../acp-runtime/session-store.js';
+import { findAcpSessionRecord, listAcpSessions } from '../acp-runtime/session-store.js';
 
 const router = express.Router();
 
@@ -29,6 +38,127 @@ async function flattenProjectSessions(project) {
     .sort((a, b) => new Date(b.lastActivity || b.updated_at || b.createdAt || 0) - new Date(a.lastActivity || a.updated_at || a.createdAt || 0));
 }
 
+async function resolveProviderSessionRoute({
+  provider,
+  sessionId,
+  projectList = null
+}) {
+  const normalizedProvider = String(provider || '').trim().toLowerCase();
+  const normalizedSessionId = String(sessionId || '').trim();
+
+  if (!normalizedProvider || !normalizedSessionId) {
+    return null;
+  }
+
+  const projects = Array.isArray(projectList) ? projectList : await getProjectsList();
+  const normalizeComparableProjectPath = (projectPath) => {
+    if (typeof projectPath !== 'string' || !projectPath.trim()) {
+      return '';
+    }
+
+    const withoutWindowsLongPathPrefix = projectPath.startsWith('\\\\?\\')
+      ? projectPath.slice(4)
+      : projectPath;
+
+    return path.normalize(withoutWindowsLongPathPrefix);
+  };
+
+  const findProjectByPath = (projectPath) => {
+    const normalizedProjectPath = normalizeComparableProjectPath(projectPath);
+    if (!normalizedProjectPath) {
+      return null;
+    }
+
+    return projects.find((project) => {
+      const candidatePath = project.fullPath || project.path || '';
+      return normalizeComparableProjectPath(candidatePath) === normalizedProjectPath;
+    }) || null;
+  };
+
+  const acpRecord = await findAcpSessionRecord(normalizedSessionId, normalizedProvider);
+  const acpProject = findProjectByPath(acpRecord?.projectPath || null);
+
+  let matchedProject = acpProject;
+  let resolvedSource = acpRecord ? 'acp' : 'legacy';
+
+  if (!matchedProject) {
+    switch (normalizedProvider) {
+      case 'claude': {
+        const metadata = await getClaudeSessionMetadata(normalizedSessionId);
+        matchedProject = findProjectByPath(metadata?.cwd || null);
+        break;
+      }
+      case 'codex': {
+        const metadata = await getCodexSessionMetadata(normalizedSessionId);
+        matchedProject = findProjectByPath(metadata?.cwd || null);
+        break;
+      }
+      case 'gemini': {
+        const metadata = await getGeminiSessionMetadata(normalizedSessionId);
+        const projectHash = String(metadata?.projectHash || '').trim();
+
+        if (projectHash) {
+          matchedProject = projects.find((project) => {
+            const projectPath = normalizeComparableProjectPath(project.fullPath || project.path || '');
+            if (!projectPath) {
+              return false;
+            }
+
+            const candidateHash = crypto.createHash('sha256').update(projectPath).digest('hex');
+            return candidateHash === projectHash;
+          }) || null;
+        }
+        break;
+      }
+      case 'opencode': {
+        const metadata = await getOpencodeSessionMetadata(normalizedSessionId);
+        matchedProject = findProjectByPath(metadata?.cwd || null);
+        break;
+      }
+      default:
+        break;
+    }
+  }
+
+  if (!matchedProject) {
+    return null;
+  }
+
+  const adapter = getProviderAdapter(normalizedProvider);
+  let sessions = [];
+
+  if (normalizedProvider === 'claude') {
+    sessions = await adapter.listSessions({
+      projectName: matchedProject.name,
+      projectPath: matchedProject.fullPath || matchedProject.path,
+      limit: 1000,
+      offset: 0
+    });
+  } else {
+    sessions = await adapter.listSessions({
+      projectPath: matchedProject.fullPath || matchedProject.path,
+      limit: 0
+    });
+  }
+
+  const matchedSession = (Array.isArray(sessions) ? sessions : []).find((session) => session.id === normalizedSessionId);
+  if (!matchedSession) {
+    return null;
+  }
+
+  return {
+    provider: normalizedProvider,
+    source: matchedSession.source || resolvedSource,
+    session: matchedSession,
+    project: {
+      name: matchedProject.name,
+      fullPath: matchedProject.fullPath || matchedProject.path,
+      path: matchedProject.path,
+      displayName: matchedProject.displayName || matchedProject.name
+    }
+  };
+}
+
 router.get('/providers', async (req, res) => {
   try {
     const providers = await discoverAllProviders({ projectPath: req.query.projectPath });
@@ -68,98 +198,29 @@ router.get('/projects/:projectName/history-index', async (req, res) => {
   }
 });
 
-router.get('/sessions/:sessionId/resolve', async (req, res) => {
+router.get('/sessions/:provider/:sessionId/resolve', async (req, res) => {
   try {
-    const projects = await getProjects();
+    const requestedProvider = String(req.params.provider || '').trim().toLowerCase();
     const requestedSessionId = String(req.params.sessionId || '').trim();
-    const providerHint = typeof req.query.provider === 'string' ? req.query.provider.trim().toLowerCase() : '';
-
-    if (!requestedSessionId) {
-      return res.status(400).json({ success: false, error: 'Session id is required' });
-    }
 
-    const providerOrder = [
-      providerHint,
-      'codex',
-      'claude',
-      'gemini',
-      'opencode'
-    ].filter((provider, index, all) => provider && all.indexOf(provider) === index);
-
-    let directProjectMatch = null;
-    let directMatchSessions = [];
-
-    for (const project of projects) {
-      const flattened = await flattenProjectSessions(project);
-      if (flattened.some((session) => session.id === requestedSessionId)) {
-        directProjectMatch = project;
-        directMatchSessions = flattened;
-        break;
-      }
+    if (!requestedProvider || !requestedSessionId) {
+      return res.status(400).json({ success: false, error: 'provider and session id are required' });
     }
 
-    if (directProjectMatch) {
-      const matchedSession = directMatchSessions.find((session) => session.id === requestedSessionId);
-
-      return res.json({
-        success: true,
-        found: true,
-        provider: matchedSession.provider,
-        source: matchedSession.source || 'legacy',
-        session: matchedSession,
-        project: {
-          name: directProjectMatch.name,
-          fullPath: directProjectMatch.fullPath || directProjectMatch.path,
-          path: directProjectMatch.path,
-          displayName: directProjectMatch.displayName || directProjectMatch.name
-        }
-      });
-    }
-
-    for (const provider of providerOrder) {
-      const adapter = getProviderAdapter(provider);
-
-      for (const project of projects) {
-        let sessions = [];
-
-        try {
-          if (provider === 'claude') {
-            const result = await adapter.listSessions({
-              projectName: project.name,
-              projectPath: project.fullPath || project.path,
-              limit: 1000,
-              offset: 0
-            });
-            sessions = Array.isArray(result) ? result : [];
-          } else {
-            sessions = await adapter.listSessions({ projectPath: project.fullPath || project.path, limit: 0 });
-          }
-        } catch (error) {
-          continue;
-        }
-
-        const matchedSession = sessions.find((session) => session.id === requestedSessionId);
-        if (!matchedSession) {
-          continue;
-        }
+    const result = await resolveProviderSessionRoute({
+      provider: requestedProvider,
+      sessionId: requestedSessionId
+    });
 
-        return res.json({
-          success: true,
-          found: true,
-          provider,
-          source: matchedSession.source || 'legacy',
-          session: matchedSession,
-          project: {
-            name: project.name,
-            fullPath: project.fullPath || project.path,
-            path: project.path,
-            displayName: project.displayName || project.name
-          }
-        });
-      }
+    if (!result) {
+      return res.status(404).json({ success: true, found: false });
     }
 
-    res.status(404).json({ success: true, found: false });
+    res.json({
+      success: true,
+      found: true,
+      ...result
+    });
   } catch (error) {
     res.status(500).json({ success: false, error: error.message });
   }
@@ -208,4 +269,6 @@ router.get('/sessions/:provider/:sessionId/events', async (req, res) => {
   }
 });
 
+export { resolveProviderSessionRoute };
+
 export default router;

package/server/session-core/eventStore.js

@@ -1,6 +1,8 @@
+import fsSync from 'fs';
 import fs from 'fs/promises';
 import os from 'os';
 import path from 'path';
+import readline from 'readline';
 
 import {
   CONVERSATION_EVENT_KINDS,
@@ -13,7 +15,11 @@ const PERSISTED_EVENT_KINDS = new Set([
   CONVERSATION_EVENT_KINDS.ERROR,
   CONVERSATION_EVENT_KINDS.APPROVAL_REQUEST,
   CONVERSATION_EVENT_KINDS.APPROVAL_RESOLVED,
-  CONVERSATION_EVENT_KINDS.SYSTEM_NOTICE
+  CONVERSATION_EVENT_KINDS.SYSTEM_NOTICE,
+  CONVERSATION_EVENT_KINDS.MODE_UPDATE,
+  CONVERSATION_EVENT_KINDS.AVAILABLE_COMMANDS_UPDATE,
+  CONVERSATION_EVENT_KINDS.PLAN_UPDATE,
+  CONVERSATION_EVENT_KINDS.ARTIFACT_CREATED
 ]);
 
 function getSessionEventFilePath(provider, sessionId) {
@@ -24,14 +30,19 @@ function normalizePersistedEvents(events = []) {
   return events.filter((event) => (
     isConversationEvent(event) &&
     event.sessionId &&
-    (
-      event.extensions?.runtimeSource === 'acp' ||
-      event.rawRef?.runtime === 'acp' ||
-      PERSISTED_EVENT_KINDS.has(event.kind)
-    )
+    PERSISTED_EVENT_KINDS.has(event.kind)
   ));
 }
 
+function extractSerializedEventKind(line) {
+  if (typeof line !== 'string' || !line) {
+    return null;
+  }
+
+  const match = line.match(/"kind"\s*:\s*"([^"]+)"/);
+  return match?.[1] || null;
+}
+
 function sortObjectKeys(value) {
   if (Array.isArray(value)) {
     return value.map(sortObjectKeys);
@@ -91,19 +102,35 @@ export async function readMirroredConversationEvents(provider, sessionId) {
   const filePath = getSessionEventFilePath(provider, sessionId);
 
   try {
-    const content = await fs.readFile(filePath, 'utf8');
-    return content
-      .split('\n')
-      .map((line) => line.trim())
-      .filter(Boolean)
-      .map((line) => {
-        try {
-          return JSON.parse(line);
-        } catch {
-          return null;
+    const fileStream = fsSync.createReadStream(filePath, { encoding: 'utf8' });
+    const rl = readline.createInterface({
+      input: fileStream,
+      crlfDelay: Infinity
+    });
+    const events = [];
+
+    for await (const rawLine of rl) {
+      const line = rawLine.trim();
+      if (!line) {
+        continue;
+      }
+
+      const kind = extractSerializedEventKind(line);
+      if (!kind || !PERSISTED_EVENT_KINDS.has(kind)) {
+        continue;
+      }
+
+      try {
+        const event = JSON.parse(line);
+        if (isConversationEvent(event) && PERSISTED_EVENT_KINDS.has(event.kind)) {
+          events.push(event);
         }
-      })
-      .filter(isConversationEvent);
+      } catch {
+        // Skip malformed lines and oversized legacy transcript events.
+      }
+    }
+
+    return events;
   } catch (error) {
     if (error?.code === 'ENOENT') {
       return [];