@axhub/genie 0.2.9 → 0.2.11

package/server/routes/commands.js

@@ -1,375 +1,362 @@
 import express from 'express';
 import { promises as fs } from 'fs';
+import os from 'os';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import os from 'os';
 import matter from 'gray-matter';
-import { CLAUDE_MODELS, CODEX_MODELS, GEMINI_MODELS, OPENCODE_MODELS } from '../../shared/modelConstants.js';
+import {
+  CLAUDE_MODELS,
+  CODEX_MODELS,
+  GEMINI_MODELS,
+  OPENCODE_MODELS
+} from '../../shared/modelConstants.js';
 import { discoverAllProviders } from '../session-core/providerDiscovery.js';
 
+const router = express.Router();
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
+const PACKAGE_JSON_PATH = path.join(__dirname, '..', '..', 'package.json');
+
+const BUILTIN_COMMANDS = [];
+const DISABLED_BUILTIN_COMMANDS = new Set([
+  '/help',
+  '/clear',
+  '/model',
+  '/memory',
+  '/config',
+  '/status',
+  '/rewind',
+]);
+
+const FALLBACK_PROVIDER_MODELS = {
+  claude: CLAUDE_MODELS.OPTIONS.map((option) => option.value),
+  codex: CODEX_MODELS.OPTIONS.map((option) => option.value),
+  gemini: GEMINI_MODELS.OPTIONS.map((option) => option.value),
+  opencode: OPENCODE_MODELS.OPTIONS.map((option) => option.value)
+};
 
-const router = express.Router();
+function trimText(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
 
-/**
- * Recursively scan directory for command files (.md)
- * @param {string} dir - Directory to scan
- * @param {string} baseDir - Base directory for relative paths
- * @param {string} namespace - Namespace for commands (e.g., 'project', 'user')
- * @returns {Promise<Array>} Array of command objects
- */
-async function scanCommandsDirectory(dir, baseDir, namespace) {
-  const commands = [];
+function commandRootsFor(projectPath) {
+  const roots = [
+    {
+      namespace: 'user',
+      rootPath: path.join(os.homedir(), '.claude', 'commands')
+    }
+  ];
 
-  try {
-    // Check if directory exists
-    await fs.access(dir);
+  if (trimText(projectPath)) {
+    roots.unshift({
+      namespace: 'project',
+      rootPath: path.join(projectPath, '.claude', 'commands')
+    });
+  }
 
-    const entries = await fs.readdir(dir, { withFileTypes: true });
+  return roots;
+}
 
-    for (const entry of entries) {
-      const fullPath = path.join(dir, entry.name);
+function normalizeCommandName(relativeFilePath) {
+  const normalized = relativeFilePath.replace(/\\/g, '/').replace(/\.md$/i, '');
+  return normalized.startsWith('/') ? normalized : `/${normalized}`;
+}
 
-      if (entry.isDirectory()) {
-        // Recursively scan subdirectories
-        const subCommands = await scanCommandsDirectory(fullPath, baseDir, namespace);
-        commands.push(...subCommands);
-      } else if (entry.isFile() && entry.name.endsWith('.md')) {
-        // Parse markdown file for metadata
-        try {
-          const content = await fs.readFile(fullPath, 'utf8');
-          const { data: frontmatter, content: commandContent } = matter(content);
-
-          // Calculate relative path from baseDir for command name
-          const relativePath = path.relative(baseDir, fullPath);
-          // Remove .md extension and convert to command name
-          const commandName = '/' + relativePath.replace(/\.md$/, '').replace(/\\/g, '/');
-
-          // Extract description from frontmatter or first line of content
-          let description = frontmatter.description || '';
-          if (!description) {
-            const firstLine = commandContent.trim().split('\n')[0];
-            description = firstLine.replace(/^#+\s*/, '').trim();
-          }
+function inferDescription(frontmatter, markdownBody) {
+  const explicit = trimText(frontmatter?.description);
+  if (explicit) {
+    return explicit;
+  }
 
-          commands.push({
-            name: commandName,
-            path: fullPath,
-            relativePath,
-            description,
-            namespace,
-            metadata: frontmatter
-          });
-        } catch (err) {
-          console.error(`Error parsing command file ${fullPath}:`, err.message);
-        }
+  const firstMeaningfulLine = markdownBody
+    .split('\n')
+    .map((line) => line.trim())
+    .find((line) => line && !line.startsWith('---'));
+
+  if (!firstMeaningfulLine) {
+    return 'Custom slash command';
+  }
+
+  return firstMeaningfulLine.replace(/^#+\s*/, '').trim() || 'Custom slash command';
+}
+
+async function walkCommandTree(rootPath, namespace) {
+  const collected = [];
+
+  async function visit(directory) {
+    let entries;
+    try {
+      entries = await fs.readdir(directory, { withFileTypes: true });
+    } catch (error) {
+      if (error.code === 'ENOENT' || error.code === 'EACCES') {
+        return;
       }
+      throw error;
     }
-  } catch (err) {
-    // Directory doesn't exist or can't be accessed - this is okay
-    if (err.code !== 'ENOENT' && err.code !== 'EACCES') {
-      console.error(`Error scanning directory ${dir}:`, err.message);
+
+    for (const entry of entries) {
+      const fullPath = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        await visit(fullPath);
+        continue;
+      }
+
+      if (!entry.isFile() || !entry.name.toLowerCase().endsWith('.md')) {
+        continue;
+      }
+
+      try {
+        const rawDocument = await fs.readFile(fullPath, 'utf8');
+        const parsedDocument = matter(rawDocument);
+        const relativePath = path.relative(rootPath, fullPath);
+        collected.push({
+          name: normalizeCommandName(relativePath),
+          path: fullPath,
+          relativePath,
+          description: inferDescription(parsedDocument.data, parsedDocument.content),
+          namespace,
+          metadata: parsedDocument.data || {}
+        });
+      } catch (error) {
+        console.error(`Error reading slash command ${fullPath}:`, error.message);
+      }
     }
   }
 
-  return commands;
+  await visit(rootPath);
+  return collected.sort((left, right) => left.name.localeCompare(right.name));
 }
 
-/**
- * Built-in commands that are always available
- */
-const builtInCommands = [
-  {
-    name: '/help',
-    description: 'Show help documentation for Claude Code',
-    namespace: 'builtin',
-    metadata: { type: 'builtin' }
-  },
-  {
-    name: '/clear',
-    description: 'Clear the conversation history',
-    namespace: 'builtin',
-    metadata: { type: 'builtin' }
-  },
-  {
-    name: '/model',
-    description: 'Switch or view the current AI model',
-    namespace: 'builtin',
-    metadata: { type: 'builtin' }
-  },
-  {
-    name: '/cost',
-    description: 'Display token usage and cost information',
-    namespace: 'builtin',
-    metadata: { type: 'builtin' }
-  },
-  {
-    name: '/memory',
-    description: 'Open CLAUDE.md memory file for editing',
-    namespace: 'builtin',
-    metadata: { type: 'builtin' }
-  },
-  {
-    name: '/config',
-    description: 'Open settings and configuration',
-    namespace: 'builtin',
-    metadata: { type: 'builtin' }
-  },
-  {
-    name: '/status',
-    description: 'Show system status and version information',
-    namespace: 'builtin',
-    metadata: { type: 'builtin' }
-  },
-  {
-    name: '/rewind',
-    description: 'Rewind the conversation to a previous state',
+function toBuiltinRecord(command) {
+  return {
+    ...command,
     namespace: 'builtin',
     metadata: { type: 'builtin' }
-  }
-];
+  };
+}
 
-/**
- * Built-in command handlers
- * Each handler returns { type: 'builtin', action: string, data: any }
- */
-const builtInHandlers = {
-  '/help': async (args, context) => {
-    const helpText = `# Claude Code Commands
+function isPathInside(basePath, targetPath) {
+  const relative = path.relative(basePath, targetPath);
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
 
-## Built-in Commands
+function resolveAllowedCommandPath(commandPath, projectPath) {
+  const resolvedPath = path.resolve(commandPath);
+  const roots = commandRootsFor(projectPath);
+  const matchedRoot = roots.find((entry) => isPathInside(path.resolve(entry.rootPath), resolvedPath));
 
-${builtInCommands.map(cmd => `### ${cmd.name}
-${cmd.description}
-`).join('\n')}
+  if (!matchedRoot) {
+    const error = new Error('Command must live in a .claude/commands directory');
+    error.statusCode = 403;
+    throw error;
+  }
 
-## Custom Commands
+  return resolvedPath;
+}
 
-Custom commands can be created in:
-- Project: \`.claude/commands/\` (project-specific)
-- User: \`~/.claude/commands/\` (available in all projects)
+async function loadCommandDocument(commandPath, projectPath) {
+  const resolvedPath = resolveAllowedCommandPath(commandPath, projectPath);
+  const raw = await fs.readFile(resolvedPath, 'utf8');
+  const parsed = matter(raw);
 
-### Command Syntax
+  return {
+    path: resolvedPath,
+    metadata: parsed.data || {},
+    content: parsed.content
+  };
+}
 
-- **Arguments**: Use \`$ARGUMENTS\` for all args or \`$1\`, \`$2\`, etc. for positional
-- **File Includes**: Use \`@filename\` to include file contents
-- **Bash Commands**: Use \`!command\` to execute bash commands
+function interpolateCommandBody(content, args) {
+  const joinedArgs = args.join(' ');
+  let nextContent = String(content || '').replace(/\$ARGUMENTS/g, joinedArgs);
 
-### Examples
+  args.forEach((arg, index) => {
+    nextContent = nextContent.replace(new RegExp(`\\$${index + 1}\\b`, 'g'), arg);
+  });
 
-\`\`\`markdown
-/mycommand arg1 arg2
-\`\`\`
-`;
+  return nextContent;
+}
 
+async function getPackageMetadata() {
+  try {
+    const raw = await fs.readFile(PACKAGE_JSON_PATH, 'utf8');
+    const parsed = JSON.parse(raw);
     return {
-      type: 'builtin',
-      action: 'help',
-      data: {
-        content: helpText,
-        format: 'markdown'
-      }
+      version: parsed.version || 'unknown',
+      packageName: parsed.name || '@axhub/genie'
     };
-  },
-
-  '/clear': async (args, context) => {
+  } catch {
     return {
-      type: 'builtin',
-      action: 'clear',
-      data: {
-        message: 'Conversation history cleared'
-      }
+      version: 'unknown',
+      packageName: '@axhub/genie'
     };
-  },
-
-  '/model': async (args, context) => {
-    const providerDiscovery = await discoverAllProviders({ projectPath: context?.projectPath });
-    const availableModels = providerDiscovery.reduce((acc, item) => {
-      acc[item.provider] = Array.isArray(item.models) && item.models.length > 0
-        ? item.models.map((entry) => entry.id)
-        : (item.provider === 'claude'
-          ? CLAUDE_MODELS.OPTIONS.map(o => o.value)
-            : item.provider === 'codex'
-              ? CODEX_MODELS.OPTIONS.map(o => o.value)
-              : item.provider === 'gemini'
-                ? GEMINI_MODELS.OPTIONS.map(o => o.value)
-                : OPENCODE_MODELS.OPTIONS.map(o => o.value));
-      return acc;
-    }, {});
-
-    const currentProvider = context?.provider || 'claude';
-    const discoveredCurrentModel = providerDiscovery.find((item) => item.provider === currentProvider)?.currentModel || null;
-    const currentModel = context?.model || discoveredCurrentModel || null;
-    const opencodeDiscovery = providerDiscovery.find((item) => item.provider === 'opencode') || null;
+  }
+}
 
-    return {
-      type: 'builtin',
-      action: 'model',
-      data: {
-        current: {
-          provider: currentProvider,
-          model: currentModel
-        },
-        available: availableModels,
-        opencodeDiscovery,
-        message: args.length > 0
-          ? `Switching to model: ${args[0]}`
-          : (currentModel ? `Current model: ${currentModel}` : 'Current model is managed by the active provider configuration.')
-      }
-    };
-  },
+async function buildModelPayload(context) {
+  const projectPath = trimText(context?.projectPath);
+  const discovered = await discoverAllProviders({ projectPath: projectPath || null });
+  const available = {};
 
-  '/status': async (args, context) => {
-    // Read version from package.json
-    const packageJsonPath = path.join(path.dirname(__dirname), '..', 'package.json');
-    let version = 'unknown';
-    let packageName = '@axhub/genie';
+  for (const provider of discovered) {
+    available[provider.provider] = Array.isArray(provider.models) && provider.models.length > 0
+      ? provider.models.map((entry) => entry.id)
+      : (FALLBACK_PROVIDER_MODELS[provider.provider] || []);
+  }
 
-    try {
-      const packageJson = JSON.parse(await fs.readFile(packageJsonPath, 'utf8'));
-      version = packageJson.version;
-      packageName = packageJson.name;
-    } catch (err) {
-      console.error('Error reading package.json:', err);
-    }
+  const currentProvider = trimText(context?.provider) || 'claude';
+  const discoveredProvider = discovered.find((entry) => entry.provider === currentProvider);
 
-    const uptime = process.uptime();
-    const uptimeMinutes = Math.floor(uptime / 60);
-    const uptimeHours = Math.floor(uptimeMinutes / 60);
-    const uptimeFormatted = uptimeHours > 0
-      ? `${uptimeHours}h ${uptimeMinutes % 60}m`
-      : `${uptimeMinutes}m`;
+  return {
+    current: {
+      provider: currentProvider,
+      model: trimText(context?.model) || trimText(discoveredProvider?.currentModel) || null
+    },
+    available
+  };
+}
 
-    return {
-      type: 'builtin',
-      action: 'status',
-      data: {
-        version,
-        packageName,
-        uptime: uptimeFormatted,
-        uptimeSeconds: Math.floor(uptime),
-        model: context?.model || null,
-        provider: context?.provider || 'claude',
-        nodeVersion: process.version,
-        platform: process.platform
+async function runBuiltinCommand(commandName, args, context) {
+  if (BUILTIN_COMMANDS.length === 0) {
+    return null;
+  }
+
+  switch (commandName) {
+    case '/help':
+      return {
+        type: 'builtin',
+        action: 'help',
+        data: {
+          content: [
+            '# Slash Commands',
+            '',
+            '## Built-in',
+            ...BUILTIN_COMMANDS.map((command) => `- \`${command.name}\` — ${command.description}`),
+            '',
+            '## Custom command folders',
+            '- Project scope: `.claude/commands/`',
+            '- User scope: `~/.claude/commands/`',
+            '',
+            'Use `$ARGUMENTS`, `$1`, `$2`, and friends inside markdown command files.'
+          ].join('\n'),
+          format: 'markdown'
+        }
+      };
+    case '/clear':
+      return {
+        type: 'builtin',
+        action: 'clear',
+        data: { message: 'Cleared the current chat preview.' }
+      };
+    case '/model':
+      return {
+        type: 'builtin',
+        action: 'model',
+        data: await buildModelPayload(context)
+      };
+    case '/memory': {
+      const projectPath = trimText(context?.projectPath);
+      if (!projectPath) {
+        return {
+          type: 'builtin',
+          action: 'memory',
+          data: {
+            error: 'No project selected',
+            message: 'Select a project before opening CLAUDE.md.'
+          }
+        };
       }
-    };
-  },
 
-  '/memory': async (args, context) => {
-    const projectPath = context?.projectPath;
+      const memoryPath = path.join(projectPath, 'CLAUDE.md');
+      let exists = true;
+      try {
+        await fs.access(memoryPath);
+      } catch {
+        exists = false;
+      }
 
-    if (!projectPath) {
       return {
         type: 'builtin',
         action: 'memory',
         data: {
-          error: 'No project selected',
-          message: 'Please select a project to access its CLAUDE.md file'
+          path: memoryPath,
+          exists,
+          message: exists
+            ? `Opening project memory at ${memoryPath}`
+            : `No CLAUDE.md found at ${memoryPath}.`
         }
       };
     }
+    case '/config':
+      return {
+        type: 'builtin',
+        action: 'config',
+        data: { message: 'Opening settings.' }
+      };
+    case '/status': {
+      const metadata = await getPackageMetadata();
+      const uptimeSeconds = Math.floor(process.uptime());
+      const uptimeMinutes = Math.floor(uptimeSeconds / 60);
+      const uptime = uptimeMinutes >= 60
+        ? `${Math.floor(uptimeMinutes / 60)}h ${uptimeMinutes % 60}m`
+        : `${uptimeMinutes}m`;
 
-    const claudeMdPath = path.join(projectPath, 'CLAUDE.md');
-
-    // Check if CLAUDE.md exists
-    let exists = false;
-    try {
-      await fs.access(claudeMdPath);
-      exists = true;
-    } catch (err) {
-      // File doesn't exist
+      return {
+        type: 'builtin',
+        action: 'status',
+        data: {
+          ...metadata,
+          uptime,
+          uptimeSeconds,
+          provider: trimText(context?.provider) || 'claude',
+          model: trimText(context?.model) || null,
+          nodeVersion: process.version,
+          platform: process.platform
+        }
+      };
     }
-
-    return {
-      type: 'builtin',
-      action: 'memory',
-      data: {
-        path: claudeMdPath,
-        exists,
-        message: exists
-          ? `Opening CLAUDE.md at ${claudeMdPath}`
-          : `CLAUDE.md not found at ${claudeMdPath}. Create it to store project-specific instructions.`
-      }
-    };
-  },
-
-  '/config': async (args, context) => {
-    return {
-      type: 'builtin',
-      action: 'config',
-      data: {
-        message: 'Opening settings...'
+    case '/rewind': {
+      const steps = Number.parseInt(String(args[0] || '1'), 10);
+      if (!Number.isFinite(steps) || steps < 1) {
+        return {
+          type: 'builtin',
+          action: 'rewind',
+          data: {
+            error: 'Invalid step count',
+            message: 'Usage: /rewind [positive-number]'
+          }
+        };
       }
-    };
-  },
 
-  '/rewind': async (args, context) => {
-    const steps = args[0] ? parseInt(args[0]) : 1;
-
-    if (isNaN(steps) || steps < 1) {
       return {
         type: 'builtin',
         action: 'rewind',
         data: {
-          error: 'Invalid steps parameter',
-          message: 'Usage: /rewind [number] - Rewind conversation by N steps (default: 1)'
+          steps,
+          message: `Removing the latest ${steps} turn${steps === 1 ? '' : 's'}.`
         }
       };
     }
-
-    return {
-      type: 'builtin',
-      action: 'rewind',
-      data: {
-        steps,
-        message: `Rewinding conversation by ${steps} step${steps > 1 ? 's' : ''}...`
-      }
-    };
+    default:
+      return null;
   }
-};
+}
 
-/**
- * POST /api/commands/list
- * List all available commands from project and user directories
- */
 router.post('/list', async (req, res) => {
   try {
-    const { projectPath } = req.body;
-    const allCommands = [...builtInCommands];
-
-    // Scan project-level commands (.claude/commands/)
-    if (projectPath) {
-      const projectCommandsDir = path.join(projectPath, '.claude', 'commands');
-      const projectCommands = await scanCommandsDirectory(
-        projectCommandsDir,
-        projectCommandsDir,
-        'project'
-      );
-      allCommands.push(...projectCommands);
-    }
-
-    // Scan user-level commands (~/.claude/commands/)
-    const homeDir = os.homedir();
-    const userCommandsDir = path.join(homeDir, '.claude', 'commands');
-    const userCommands = await scanCommandsDirectory(
-      userCommandsDir,
-      userCommandsDir,
-      'user'
-    );
-    allCommands.push(...userCommands);
+    const projectPath = trimText(req.body?.projectPath);
+    const builtin = BUILTIN_COMMANDS.map(toBuiltinRecord);
+    const discoveredRoots = commandRootsFor(projectPath);
+    const custom = [];
 
-    // Separate built-in and custom commands
-    const customCommands = allCommands.filter(cmd => cmd.namespace !== 'builtin');
-
-    // Sort commands alphabetically by name
-    customCommands.sort((a, b) => a.name.localeCompare(b.name));
+    for (const root of discoveredRoots) {
+      custom.push(...await walkCommandTree(root.rootPath, root.namespace));
+    }
 
     res.json({
-      builtIn: builtInCommands,
-      custom: customCommands,
-      count: allCommands.length
+      builtIn: builtin,
+      custom,
+      count: builtin.length + custom.length
     });
   } catch (error) {
     console.error('Error listing commands:', error);
@@ -380,151 +367,92 @@ router.post('/list', async (req, res) => {
   }
 });
 
-/**
- * POST /api/commands/load
- * Load a specific command file and return its content and metadata
- */
 router.post('/load', async (req, res) => {
-  try {
-    const { commandPath } = req.body;
-
-    if (!commandPath) {
-      return res.status(400).json({
-        error: 'Command path is required'
-      });
-    }
-
-    // Security: Prevent path traversal
-    const resolvedPath = path.resolve(commandPath);
-    if (!resolvedPath.startsWith(path.resolve(os.homedir())) &&
-        !resolvedPath.includes('.claude/commands')) {
-      return res.status(403).json({
-        error: 'Access denied',
-        message: 'Command must be in .claude/commands directory'
-      });
-    }
-
-    // Read and parse the command file
-    const content = await fs.readFile(commandPath, 'utf8');
-    const { data: metadata, content: commandContent } = matter(content);
+  const commandPath = trimText(req.body?.commandPath);
+  const projectPath = trimText(req.body?.projectPath);
 
-    res.json({
-      path: commandPath,
-      metadata,
-      content: commandContent
+  if (!commandPath) {
+    return res.status(400).json({
+      error: 'Command path is required'
     });
+  }
+
+  try {
+    const document = await loadCommandDocument(commandPath, projectPath);
+    res.json(document);
   } catch (error) {
     if (error.code === 'ENOENT') {
       return res.status(404).json({
         error: 'Command not found',
-        message: `Command file not found: ${req.body.commandPath}`
+        message: `Command file not found: ${commandPath}`
       });
     }
 
-    console.error('Error loading command:', error);
-    res.status(500).json({
-      error: 'Failed to load command',
+    res.status(error.statusCode || 500).json({
+      error: error.statusCode ? 'Access denied' : 'Failed to load command',
       message: error.message
     });
   }
 });
 
-/**
- * POST /api/commands/execute
- * Execute a command with argument replacement
- * This endpoint prepares the command content but doesn't execute bash commands yet
- * (that will be handled in the command parser utility)
- */
 router.post('/execute', async (req, res) => {
-  try {
-    const { commandName, commandPath, args = [], context = {} } = req.body;
+  const commandName = trimText(req.body?.commandName);
+  const commandPath = trimText(req.body?.commandPath);
+  const args = Array.isArray(req.body?.args) ? req.body.args.map((value) => String(value)) : [];
+  const context = req.body?.context && typeof req.body.context === 'object' ? req.body.context : {};
+
+  if (!commandName) {
+    return res.status(400).json({
+      error: 'Command name is required'
+    });
+  }
 
-    if (!commandName) {
-      return res.status(400).json({
-        error: 'Command name is required'
-      });
-    }
+  if (DISABLED_BUILTIN_COMMANDS.has(commandName)) {
+    return res.status(404).json({
+      error: 'Command not found',
+      message: `${commandName} is currently disabled`,
+      command: commandName
+    });
+  }
 
-    // Handle built-in commands
-    const handler = builtInHandlers[commandName];
-    if (handler) {
-      try {
-        const result = await handler(args, context);
-        return res.json({
-          ...result,
-          command: commandName
-        });
-      } catch (error) {
-        console.error(`Error executing built-in command ${commandName}:`, error);
-        return res.status(500).json({
-          error: 'Command execution failed',
-          message: error.message,
-          command: commandName
-        });
-      }
+  try {
+    const builtinResult = await runBuiltinCommand(commandName, args, context);
+    if (builtinResult) {
+      return res.json({
+        command: commandName,
+        ...builtinResult
+      });
     }
 
-    // Handle custom commands
     if (!commandPath) {
       return res.status(400).json({
         error: 'Command path is required for custom commands'
       });
     }
 
-    // Load command content
-    // Security: validate commandPath is within allowed directories
-    {
-      const resolvedPath = path.resolve(commandPath);
-      const userBase = path.resolve(path.join(os.homedir(), '.claude', 'commands'));
-      const projectBase = context?.projectPath
-        ? path.resolve(path.join(context.projectPath, '.claude', 'commands'))
-        : null;
-      const isUnder = (base) => {
-        const rel = path.relative(base, resolvedPath);
-        return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
-      };
-      if (!(isUnder(userBase) || (projectBase && isUnder(projectBase)))) {
-        return res.status(403).json({
-          error: 'Access denied',
-          message: 'Command must be in .claude/commands directory'
-        });
-      }
-    }
-    const content = await fs.readFile(commandPath, 'utf8');
-    const { data: metadata, content: commandContent } = matter(content);
-    // Basic argument replacement (will be enhanced in command parser utility)
-    let processedContent = commandContent;
-
-    // Replace $ARGUMENTS with all arguments joined
-    const argsString = args.join(' ');
-    processedContent = processedContent.replace(/\$ARGUMENTS/g, argsString);
-
-    // Replace $1, $2, etc. with positional arguments
-    args.forEach((arg, index) => {
-      const placeholder = `$${index + 1}`;
-      processedContent = processedContent.replace(new RegExp(`\\${placeholder}\\b`, 'g'), arg);
-    });
+    const document = await loadCommandDocument(commandPath, trimText(context.projectPath));
+    const preparedContent = interpolateCommandBody(document.content, args);
 
     res.json({
       type: 'custom',
       command: commandName,
-      content: processedContent,
-      metadata,
-      hasFileIncludes: processedContent.includes('@'),
-      hasBashCommands: processedContent.includes('!')
+      metadata: document.metadata,
+      content: preparedContent,
+      hasFileIncludes: /(^|\s)@[\w./-]+/m.test(preparedContent),
+      hasBashCommands: /(^|\n)\s*!/.test(preparedContent)
     });
   } catch (error) {
     if (error.code === 'ENOENT') {
       return res.status(404).json({
         error: 'Command not found',
-        message: `Command file not found: ${req.body.commandPath}`
+        message: `Command file not found: ${commandPath}`
       });
     }
 
-    console.error('Error executing command:', error);
-    res.status(500).json({
-      error: 'Failed to execute command',
-      message: error.message
+    res.status(error.statusCode || 500).json({
+      error: error.statusCode ? 'Access denied' : 'Command execution failed',
+      message: error.message,
+      command: commandName
     });
   }
 });