@cloudcli-ai/cloudcli 1.37.2 → 1.37.4

package/server/modules/user/tests/user.service.test.ts

@@ -13,6 +13,15 @@ function createDependencies(overrides: Partial<UserDependencies> = {}): UserDepe
       completeOnboarding: () => undefined,
       hasCompletedOnboarding: () => false,
     },
+    preferences: {
+      getPreferences: () => ({}),
+      savePreferences: () => undefined,
+    },
+    drafts: {
+      getDrafts: () => [],
+      saveDraft: () => undefined,
+      deleteDraft: () => undefined,
+    },
     readSystemGitConfig: async () => ({ git_name: null, git_email: null }),
     applyGlobalGitConfig: async () => undefined,
     logInfo: () => undefined,
@@ -59,3 +68,84 @@ test('updateGitConfig persists valid input and invokes the Git adapter', async (
     'git:Alice:alice@example.com',
   ]);
 });
+
+test('savePreferences forwards only the keys the client sent', () => {
+  const saved: Array<Record<string, unknown>> = [];
+  const service = createUserService(createDependencies({
+    preferences: {
+      getPreferences: () => ({ theme: 'dark' }),
+      savePreferences: (_id, updates) => saved.push(updates),
+    },
+  }));
+
+  const result = service.savePreferences(3, { theme: 'light' });
+
+  assert.deepEqual(saved, [{ theme: 'light' }]);
+  assert.deepEqual(result.preferences, { theme: 'dark' });
+});
+
+test('savePreferences rejects a non-object body', () => {
+  const service = createUserService(createDependencies());
+
+  assert.throws(() => service.savePreferences(3, ['theme']), /object/i);
+  assert.throws(() => service.savePreferences(3, 'theme'), /object/i);
+});
+
+test('savePreferences rejects an over-long preference key', () => {
+  const service = createUserService(createDependencies());
+
+  assert.throws(() => service.savePreferences(3, { ['k'.repeat(201)]: 1 }), /1-200/);
+});
+
+test('saveDraft stores the text and queued message under the given scope', () => {
+  const saved: unknown[][] = [];
+  const service = createUserService(createDependencies({
+    drafts: {
+      getDrafts: () => [],
+      saveDraft: (...args) => saved.push(args),
+      deleteDraft: () => undefined,
+    },
+  }));
+
+  service.saveDraft(5, 'session-1', {
+    scope: 'session-1',
+    text: 'half a thought',
+    queuedMessage: { content: 'later' },
+  });
+
+  assert.deepEqual(saved, [[5, 'session-1', {
+    text: 'half a thought',
+    queuedMessage: { content: 'later' },
+  }]]);
+});
+
+test('saveDraft defaults a missing queued message to null rather than dropping the row', () => {
+  const saved: unknown[][] = [];
+  const service = createUserService(createDependencies({
+    drafts: {
+      getDrafts: () => [],
+      saveDraft: (...args) => saved.push(args),
+      deleteDraft: () => undefined,
+    },
+  }));
+
+  service.saveDraft(5, 'session-1', { scope: 'session-1', text: 'typing' });
+
+  assert.deepEqual(saved, [[5, 'session-1', { text: 'typing', queuedMessage: null }]]);
+});
+
+test('saveDraft rejects a blank or over-long scope', () => {
+  const service = createUserService(createDependencies());
+
+  assert.throws(() => service.saveDraft(5, '   ', { text: 'x' }), /scope/i);
+  assert.throws(() => service.saveDraft(5, 'x'.repeat(201), { text: 'x' }), /scope/i);
+});
+
+test('saveDraft rejects text past the storage limit', () => {
+  const service = createUserService(createDependencies());
+
+  assert.throws(
+    () => service.saveDraft(5, 'session-1', { text: 'x'.repeat(100_001) }),
+    /too long/i,
+  );
+});

package/server/modules/user/user.module.ts

@@ -1,6 +1,6 @@
 import spawn from 'cross-spawn';
 
-import { userDb } from '@/modules/database/index.js';
+import { sessionDraftsDb, userDb, userPreferencesDb } from '@/modules/database/index.js';
 
 import { createUserRouter } from './user.routes.js';
 import { createUserService } from './user.service.js';
@@ -45,6 +45,15 @@ const userService = createUserService({
     completeOnboarding: (userId) => userDb.completeOnboarding(userId),
     hasCompletedOnboarding: (userId) => userDb.hasCompletedOnboarding(userId),
   },
+  preferences: {
+    getPreferences: (userId) => userPreferencesDb.getPreferences(userId),
+    savePreferences: (userId, updates) => userPreferencesDb.savePreferences(userId, updates),
+  },
+  drafts: {
+    getDrafts: (userId) => sessionDraftsDb.getDrafts(userId),
+    saveDraft: (userId, scope, draft) => sessionDraftsDb.saveDraft(userId, scope, draft),
+    deleteDraft: (userId, scope) => sessionDraftsDb.deleteDraft(userId, scope),
+  },
   readSystemGitConfig,
   applyGlobalGitConfig: async (gitName, gitEmail) => {
     await runGit(['config', '--global', 'user.name', gitName]);

package/server/modules/user/user.routes.ts

@@ -46,5 +46,49 @@ export function createUserRouter(service: ReturnType<typeof createUserService>):
     }
   });
 
+  router.get('/preferences', (req, res, next) => {
+    try {
+      res.json(service.getPreferences(readUserId(req)));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.patch('/preferences', (req, res, next) => {
+    try {
+      res.json(service.savePreferences(readUserId(req), req.body));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.get('/drafts', (req, res, next) => {
+    try {
+      res.json(service.getDrafts(readUserId(req)));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  // The scope is a session id or `project:<id>`, so it is read from the body
+  // rather than the path: neither form is guaranteed to be URL-path-safe.
+  router.put('/drafts', (req, res, next) => {
+    try {
+      const body = req.body as { scope?: unknown };
+      res.json(service.saveDraft(readUserId(req), body?.scope, req.body));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.delete('/drafts', (req, res, next) => {
+    try {
+      const body = req.body as { scope?: unknown };
+      res.json(service.deleteDraft(readUserId(req), body?.scope));
+    } catch (error) {
+      next(error);
+    }
+  });
+
   return router;
 }

package/server/modules/user/user.service.ts

@@ -5,6 +5,14 @@ type GitConfig = {
   git_email: string | null;
 };
 
+/** One chat scope's unsent composer text and queued message. */
+type DraftRecord = {
+  scope: string;
+  text: string;
+  queuedMessage: unknown | null;
+  updatedAt: string;
+};
+
 type UserDependencies = {
   users: {
     getGitConfig(userId: number): GitConfig | undefined;
@@ -12,12 +20,65 @@ type UserDependencies = {
     completeOnboarding(userId: number): void;
     hasCompletedOnboarding(userId: number): boolean;
   };
+  preferences: {
+    getPreferences(userId: number): Record<string, unknown>;
+    savePreferences(userId: number, updates: Record<string, unknown>): void;
+  };
+  drafts: {
+    getDrafts(userId: number): DraftRecord[];
+    saveDraft(userId: number, scope: string, draft: { text: string; queuedMessage: unknown | null }): void;
+    deleteDraft(userId: number, scope: string): void;
+  };
   readSystemGitConfig(): Promise<GitConfig>;
   applyGlobalGitConfig(gitName: string, gitEmail: string): Promise<void>;
   logInfo(message: string): void;
   logError(message: string, error: unknown): void;
 };
 
+/**
+ * The longest a draft scope or preference key may be.
+ *
+ * Scopes are session UUIDs or `project:<id>`, and preference keys are fixed
+ * identifiers, so anything longer is a client bug or an attempt to use the
+ * table as general storage.
+ */
+const MAX_KEY_LENGTH = 200;
+
+/** Guards against a runaway composer filling the database with one row. */
+const MAX_DRAFT_TEXT_LENGTH = 100_000;
+
+const readDraftScope = (value: unknown): string => {
+  const scope = typeof value === 'string' ? value.trim() : '';
+  if (!scope || scope.length > MAX_KEY_LENGTH) {
+    throw new AppError('A draft scope of 1-200 characters is required', {
+      code: 'INVALID_DRAFT_SCOPE',
+      statusCode: 400,
+    });
+  }
+  return scope;
+};
+
+const readPreferenceUpdates = (body: unknown): Record<string, unknown> => {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    throw new AppError('Preferences must be sent as an object', {
+      code: 'INVALID_PREFERENCES',
+      statusCode: 400,
+    });
+  }
+
+  const updates = body as Record<string, unknown>;
+  for (const key of Object.keys(updates)) {
+    if (!key || key.length > MAX_KEY_LENGTH) {
+      throw new AppError('Preference keys must be 1-200 characters', {
+        code: 'INVALID_PREFERENCE_KEY',
+        statusCode: 400,
+      });
+    }
+  }
+
+  return updates;
+};
+
 /** Creates user-profile workflows with explicit repository and Git adapters. */
 export function createUserService(dependencies: UserDependencies) {
   return {
@@ -81,5 +142,49 @@ export function createUserService(dependencies: UserDependencies) {
         hasCompletedOnboarding: dependencies.users.hasCompletedOnboarding(userId),
       };
     },
+
+    /** Every stored preference at once; the client fills gaps with its defaults. */
+    getPreferences(userId: number) {
+      return { success: true, preferences: dependencies.preferences.getPreferences(userId) };
+    },
+
+    /**
+     * Merge-patch: only the keys in the request body are touched, so two
+     * independent settings screens can save concurrently without one erasing
+     * the other's work.
+     */
+    savePreferences(userId: number, body: unknown) {
+      const updates = readPreferenceUpdates(body);
+      dependencies.preferences.savePreferences(userId, updates);
+      return { success: true, preferences: dependencies.preferences.getPreferences(userId) };
+    },
+
+    getDrafts(userId: number) {
+      return { success: true, drafts: dependencies.drafts.getDrafts(userId) };
+    },
+
+    saveDraft(userId: number, scopeInput: unknown, body: unknown) {
+      const scope = readDraftScope(scopeInput);
+      const payload = (body ?? {}) as { text?: unknown; queuedMessage?: unknown };
+      const text = typeof payload.text === 'string' ? payload.text : '';
+
+      if (text.length > MAX_DRAFT_TEXT_LENGTH) {
+        throw new AppError('Draft text is too long to store', {
+          code: 'DRAFT_TEXT_TOO_LONG',
+          statusCode: 413,
+        });
+      }
+
+      dependencies.drafts.saveDraft(userId, scope, {
+        text,
+        queuedMessage: payload.queuedMessage ?? null,
+      });
+      return { success: true };
+    },
+
+    deleteDraft(userId: number, scopeInput: unknown) {
+      dependencies.drafts.deleteDraft(userId, readDraftScope(scopeInput));
+      return { success: true };
+    },
   };
 }

package/server/modules/voice/tests/voice.service.test.ts

@@ -47,8 +47,9 @@ test('transcribes with injected fetch and request-level credential/model overrid
 
   assert.deepEqual(result, { ok: true, value: { text: 'hello' } });
   assert.equal(requestedUrl, 'https://voice.example/v1/audio/transcriptions');
-  assert.equal((requestedOptions?.headers as Record<string, string>).Authorization, 'Bearer request-key');
-  assert.equal((requestedOptions?.body as FormData).get('model'), 'custom-whisper');
+  assert.ok(requestedOptions, 'fetchBackend should receive request options');
+  assert.equal((requestedOptions.headers as Record<string, string>).Authorization, 'Bearer request-key');
+  assert.equal((requestedOptions.body as FormData).get('model'), 'custom-whisper');
 });
 
 test('forwards the explicit TTS format and maps backend authentication failures', async () => {

package/server/modules/websocket/README.md

@@ -33,7 +33,7 @@ Benefits:
 |---|---|
 | `services/websocket-server.service.ts` | Creates `WebSocketServer`, binds `verifyClient`, routes connection by pathname |
 | `services/websocket-auth.service.ts` | Authenticates upgrade requests and attaches `request.user` |
-| `services/chat-websocket.service.ts` | Handles the `/ws` chat protocol (`chat.send` / `chat.abort` / `chat.subscribe` / `chat.permission-response`) |
+| `services/chat-websocket.service.ts` | Handles the `/ws` chat protocol (`chat.send` / `chat.abort` / `chat.stop-task` / `chat.subscribe` / `chat.permission-response`) |
 | `services/chat-run-registry.service.ts` | Tracks live provider runs per app session id: seq numbering, event replay buffer, provider-id mapping, completion state |
 | `services/chat-session-writer.service.ts` | Gateway writer handed to provider runtimes: remaps provider session ids to app ids, swallows `session_created`, assigns `seq` |
 | `services/shell-websocket.service.ts` | Handles `/shell` PTY lifecycle, reconnect buffering, auth URL detection |
@@ -108,7 +108,7 @@ When a chat socket connects:
 
 1. Add socket to `connectedClients`.
 2. Parse each incoming message with `parseIncomingJsonObject`.
-3. Dispatch by `data.type` (four message types, none provider-specific).
+3. Dispatch by `data.type` (six message types, none provider-specific).
 4. On close, remove socket from `connectedClients`.
 
 ### Session identity model
@@ -130,7 +130,9 @@ flowchart TD
   B -->|ok| D{data.type}
 
   D -->|chat.send| E[resolve session row -> startRun -> providerRuntimeService.run]
+  D -->|chat.edit-send| E2[history_truncated -> rewind or resume at the anchor -> same as chat.send]
   D -->|chat.abort| F[providerRuntimeService.abort + synthetic complete]
+  D -->|chat.stop-task| F2[providerRuntimeService.stopBackgroundTask]
   D -->|chat.subscribe| G[chat_subscribed ack + attach socket + replay events seq > lastSeq]
   D -->|chat.permission-response| H[providerRuntimeService.resolveToolApproval]
   D -->|other| I[send kind:protocol_error]

package/server/modules/websocket/index.ts

@@ -1,3 +1,11 @@
 export { WS_OPEN_STATE, connectedClients } from './services/websocket-state.service.js';
 export { createWebSocketServer } from './services/websocket-server.service.js';
 export { chatRunRegistry } from './services/chat-run-registry.service.js';
+// Consumed by the providers module's sessions watcher, which announces the
+// sessions it (re)indexed from disk through the same builder the chat gateway
+// uses, so both paths put the identical delta on the wire.
+export { broadcastSessionUpserted, broadcastSessionUpsertedBatch } from './services/session-upsert-broadcast.service.js';
+// runDetachedChatTurn: used by the scheduled-messages module to run a turn
+// from a timer, with no socket to stream to or report errors on.
+export { runDetachedChatTurn } from './services/chat-websocket.service.js';
+export type { ProviderRuntimeGateway } from './services/chat-websocket.service.js';

package/server/modules/websocket/services/chat-run-registry.service.ts

@@ -1,9 +1,6 @@
-import path from 'node:path';
-
-import { projectsDb, sessionsDb } from '@/modules/database/index.js';
-import { generateDisplayName } from '@/modules/projects/index.js';
+import { sessionsDb } from '@/modules/database/index.js';
 import { ChatSessionWriter } from '@/modules/websocket/services/chat-session-writer.service.js';
-import { connectedClients, WS_OPEN_STATE } from '@/modules/websocket/services/websocket-state.service.js';
+import { broadcastSessionUpserted } from '@/modules/websocket/services/session-upsert-broadcast.service.js';
 import type {
   LLMProvider,
   NormalizedMessage,
@@ -62,54 +59,31 @@ const MAX_BUFFERED_EVENTS_PER_RUN = 5000;
  */
 const runs = new Map<string, ChatRun>();
 
-async function broadcastCanonicalSessionUpsert(appSessionId: string): Promise<void> {
-  const row = sessionsDb.getSessionById(appSessionId);
-  if (!row || row.isArchived) {
-    return;
-  }
-
-  const projectPath = row.project_path;
-  const project = projectPath ? projectsDb.getProjectPath(projectPath) : null;
-  const displayName = project?.custom_project_name?.trim()
-    ? project.custom_project_name
-    : await generateDisplayName(path.basename(projectPath ?? '') || (projectPath ?? ''), projectPath);
-
-  const payload = JSON.stringify({
-    kind: 'session_upserted',
-    sessionId: row.session_id,
-    providerSessionId: row.provider_session_id,
-    provider: row.provider,
-    session: {
-      id: row.session_id,
-      summary: row.custom_name || '',
-      messageCount: 0,
-      lastActivity: row.updated_at ?? row.created_at ?? new Date().toISOString(),
-    },
-    project: project
-      ? {
-        projectId: project.project_id,
-        path: project.project_path,
-        fullPath: project.project_path,
-        displayName,
-        isStarred: Boolean(project.isStarred),
-      }
-      : null,
-    timestamp: new Date().toISOString(),
-  });
-
-  connectedClients.forEach((client) => {
-    if (client.readyState === WS_OPEN_STATE) {
-      client.send(payload);
-    }
-  });
-}
+/**
+ * Answers whether a completed run must stay registered a while longer. Set by
+ * the composition root to the provider runtimes' background-work check: a
+ * session whose turn ended but whose agents, workflows or commands are still
+ * running keeps sending live events through this run's writer, and a tab that
+ * subscribes meanwhile needs the run to attach to.
+ */
+let retainCompletedRun: (appSessionId: string) => boolean = () => false;
 
-function evictRunLater(appSessionId: string): void {
+/**
+ * Schedules one run's eviction. The timer is bound to the run it was armed
+ * for: a later run can take the session's slot while this one's retention —
+ * re-armed for as long as the guard holds — is still pending, and firing on
+ * the slot alone would evict that newer run early.
+ */
+function evictRunLater(run: ChatRun): void {
   const timer = setTimeout(() => {
-    const run = runs.get(appSessionId);
-    if (run && run.status === 'completed') {
-      runs.delete(appSessionId);
+    if (runs.get(run.appSessionId) !== run || run.status !== 'completed') {
+      return;
+    }
+    if (retainCompletedRun(run.appSessionId)) {
+      evictRunLater(run);
+      return;
     }
+    runs.delete(run.appSessionId);
   }, COMPLETED_RUN_RETENTION_MS);
 
   // Never keep the process alive just to evict a buffered run.
@@ -149,7 +123,7 @@ function decorateAndRecordEvent(run: ChatRun, message: NormalizedMessage): Norma
     outbound.actualSessionId = run.appSessionId;
     run.status = 'completed';
     run.completedAt = Date.now();
-    evictRunLater(run.appSessionId);
+    evictRunLater(run);
   }
 
   run.events.push(outbound);
@@ -178,7 +152,7 @@ function recordProviderSessionId(run: ChatRun, providerSessionId: string): void
 
   try {
     sessionsDb.assignProviderSessionId(run.appSessionId, providerSessionId);
-    void broadcastCanonicalSessionUpsert(run.appSessionId).catch((error) => {
+    void broadcastSessionUpserted(run.appSessionId).catch((error) => {
       const message = error instanceof Error ? error.message : String(error);
       console.error('[ChatRunRegistry] Failed to broadcast canonical session mapping', {
         appSessionId: run.appSessionId,
@@ -205,6 +179,11 @@ function recordProviderSessionId(run: ChatRun, providerSessionId: string): void
  * regardless of which provider runtime produced them.
  */
 export const chatRunRegistry = {
+  /** Installs the check that keeps a completed run registered while its session still has background work. */
+  setRetentionGuard(guard: (appSessionId: string) => boolean): void {
+    retainCompletedRun = guard;
+  },
+
   /**
    * Starts tracking a run and returns it, or `null` when a run is already in
    * progress for the session (callers must reject the duplicate send).
@@ -213,7 +192,13 @@ export const chatRunRegistry = {
     appSessionId: string;
     provider: LLMProvider;
     providerSessionId: string | null;
-    connection: RealtimeClientConnection;
+    /**
+     * The socket that asked for this run, or `null` for one nobody is watching
+     * — a scheduled message fires with no browser attached. The writer's event
+     * buffer still records everything, so a client that subscribes later
+     * replays the run from its start.
+     */
+    connection: RealtimeClientConnection | null;
     userId: string | number | null;
   }): ChatRun | null {
     const existing = runs.get(input.appSessionId);
@@ -273,11 +258,17 @@ export const chatRunRegistry = {
   },
 
   /**
-   * Re-attaches a run's outbound stream to a (new) websocket connection.
+   * Adds a websocket connection to a run's live audience.
    *
    * This is the generic replacement for the Claude-only writer reconnect:
    * after a page refresh the new socket subscribes and immediately starts
    * receiving the still-running stream, for every provider.
+   *
+   * Subscribing does not take the stream away from sockets that were already
+   * watching — a session open in two places stays live in both, and the
+   * refreshed tab's abandoned socket is dropped when the next event finds it
+   * closed. Replay stays per-connection because each client sends its own
+   * `lastSeq` with `chat.subscribe`.
    */
   attachConnection(appSessionId: string, connection: RealtimeClientConnection): boolean {
     const run = runs.get(appSessionId);

package/server/modules/websocket/services/chat-session-writer.service.ts

@@ -7,7 +7,7 @@ import type {
 import { createCompleteMessage, readObjectRecord } from '@/shared/utils.js';
 
 type ChatSessionWriterOptions = {
-  connection: RealtimeClientConnection;
+  connection: RealtimeClientConnection | null;
   userId: string | number | null;
   provider: LLMProvider;
   /** Provider-native id when resuming an existing session, otherwise null. */
@@ -44,7 +44,6 @@ type ChatSessionWriterOptions = {
  *   intercepted and recorded as the provider-id mapping as well.
  */
 export class ChatSessionWriter {
-  ws: RealtimeClientConnection;
   userId: string | number | null;
   /**
    * Some runtimes feature-detect their writer with this flag; keep it so the
@@ -53,6 +52,17 @@ export class ChatSessionWriter {
   isWebSocketWriter = true;
 
   private readonly options: ChatSessionWriterOptions;
+  /**
+   * Every socket currently watching this run, not just the one that started
+   * it. A session can legitimately be open in more than one place — a second
+   * browser tab, a phone alongside a laptop, the desktop app beside the web
+   * app — and each of those subscribes through `attachConnection`.
+   *
+   * Holding a single connection here meant the newest subscriber took the
+   * stream away from everyone before it, so a second tab silently froze
+   * mid-run and only caught up on the next REST history refresh.
+   */
+  private readonly connections = new Set<RealtimeClientConnection>();
   /**
    * The provider-native session id as the runtime knows it. Kept locally
    * (besides the registry) because runtimes read it back via `getSessionId()`
@@ -63,7 +73,12 @@ export class ChatSessionWriter {
 
   constructor(options: ChatSessionWriterOptions) {
     this.options = options;
-    this.ws = options.connection;
+    // A run started by a timer has no audience yet. Everything still goes
+    // through `decorateOutboundEvent` into the run's replay buffer, so a
+    // client that subscribes mid-run catches up from the beginning.
+    if (options.connection) {
+      this.connections.add(options.connection);
+    }
     this.userId = options.userId;
     this.providerSessionId = options.providerSessionId;
   }
@@ -116,8 +131,13 @@ export class ChatSessionWriter {
     }
   }
 
+  /**
+   * Adds a socket to the run's live audience. Named for the `WebSocketWriter`
+   * method it stands in for, so runtime adapters keep working unchanged —
+   * but it adds rather than replaces.
+   */
   updateWebSocket(newConnection: RealtimeClientConnection): void {
-    this.ws = newConnection;
+    this.connections.add(newConnection);
   }
 
   setSessionId(sessionId: string): void {
@@ -138,8 +158,18 @@ export class ChatSessionWriter {
   }
 
   private forward(message: NormalizedMessage): void {
-    if (this.ws.readyState === WS_OPEN_STATE) {
-      this.ws.send(JSON.stringify(message));
+    const payload = JSON.stringify(message);
+
+    // Sending is also when dead sockets get collected: a refreshed tab leaves
+    // its old connection behind, and without dropping it here the set would
+    // grow for the whole life of the run. Deleting during iteration is safe
+    // for a Set — the removed entry is simply not revisited.
+    for (const connection of this.connections) {
+      if (connection.readyState === WS_OPEN_STATE) {
+        connection.send(payload);
+      } else {
+        this.connections.delete(connection);
+      }
     }
   }
 }