@cloudcli-ai/cloudcli 1.37.2 → 1.37.4

package/server/shared/utils.ts

@@ -27,6 +27,7 @@ import type {
   ProviderCurrentActiveModel,
   ProviderModelsDefinition,
   ProviderSkillSource,
+  SubagentActivity,
   WorkspacePathValidationResult,
 } from '@/shared/types.js';
 
@@ -110,6 +111,20 @@ export class AppError extends Error {
   }
 }
 
+/**
+ * Flattens a failed `git` invocation into one searchable string: the error
+ * message followed by whatever stderr/stdout the process runner attached.
+ *
+ * Used by the Git routes and the branch compare service to classify git
+ * failures (e.g. "not a git repository", "unknown revision") and to surface
+ * git's own explanation as error `details`. Accepts any thrown value; missing
+ * fields contribute nothing, so the result may be empty.
+ */
+export function getGitErrorDetails(error: unknown): string {
+  const details = error as { message?: string; stderr?: string; stdout?: string } | null;
+  return `${details?.message ?? ''} ${details?.stderr ?? ''} ${details?.stdout ?? ''}`.trim();
+}
+
 // ---------------------------
 //----------------- WORKSPACE PATH VALIDATION UTILITIES ------------
 /**
@@ -153,6 +168,83 @@ export const FORBIDDEN_WORKSPACE_PATHS = [
   'C:\\$Recycle.Bin',
 ];
 
+/**
+ * Roots the file browser and viewer may read from even though they are outside
+ * every project.
+ *
+ * Claude writes a background agent's output file and a background command's log
+ * under the system temp directory, and a transcript quotes those paths
+ * verbatim, so the file browser and the file viewer have to be able to follow
+ * them. `/tmp` is listed literally as well as via `os.tmpdir()` because the two
+ * differ on macOS, where the temp directory is under `/var/folders`.
+ *
+ * A background agent's `.output` file is only a symlink to the agent's
+ * transcript, `~/.claude/projects/<project>/<session>/subagents/agent-<id>.jsonl`.
+ * Symlinks are resolved before the root comparison, so following it needs the
+ * Claude projects directory to be a root as well. Those are the user's own
+ * transcripts, which the sessions API already serves; the directory is located
+ * the same way the session watcher and synchronizer locate it.
+ *
+ * Being a read-only root grants reads only: the file-tree write paths resolve
+ * against the project root alone, so nothing under these can be changed
+ * through the file API. Whether one may become a workspace is decided
+ * separately by `validateWorkspacePath` — the temp directories are on
+ * `FORBIDDEN_WORKSPACE_PATHS`; the Claude projects directory is not, it is
+ * simply wherever `WORKSPACES_ROOT` puts it.
+ */
+const READ_ONLY_ROOTS = [...new Set([
+  '/tmp',
+  os.tmpdir(),
+  path.join(os.homedir(), '.claude', 'projects'),
+])];
+
+/**
+ * Resolves `targetPath` when it lives under one of `roots`, or `null` when it
+ * does not.
+ *
+ * Symlinks are resolved before the comparison, so a link planted under a root
+ * cannot be used to read somewhere else through it. Each root is resolved on
+ * its own, so one that does not exist on this machine — `/tmp` on Windows — is
+ * skipped and the roots after it are still checked.
+ */
+export async function resolvePathUnderRoots(targetPath: string, roots: string[]): Promise<string | null> {
+  const normalizedTarget = normalizeProjectPath(targetPath);
+  if (!normalizedTarget || !path.isAbsolute(normalizedTarget)) {
+    return null;
+  }
+
+  let resolvedPath: string;
+  try {
+    resolvedPath = normalizeProjectPath(await realpath(path.resolve(normalizedTarget)));
+  } catch {
+    // A path that cannot be resolved is not readable through here either.
+    return null;
+  }
+
+  for (const root of roots) {
+    let resolvedRoot: string;
+    try {
+      resolvedRoot = normalizeProjectPath(await realpath(root));
+    } catch {
+      continue;
+    }
+
+    if (resolvedPath === resolvedRoot || resolvedPath.startsWith(`${resolvedRoot}${path.sep}`)) {
+      return resolvedPath;
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Resolves a path that is readable because it lives under a read-only root,
+ * or `null` when it does not.
+ */
+export function resolveReadOnlyRootPath(targetPath: string): Promise<string | null> {
+  return resolvePathUnderRoots(targetPath, READ_ONLY_ROOTS);
+}
+
 function stripWindowsLongPathPrefix(inputPath: string): string {
   if (inputPath.startsWith('\\\\?\\UNC\\')) {
     return `\\\\${inputPath.slice('\\\\?\\UNC\\'.length)}`;
@@ -391,6 +483,45 @@ export function createCompleteMessage(opts: {
   });
 }
 
+// ---------------------------
+//----------------- SUBAGENT TIMELINE UTILITIES ------------
+/**
+ * Longest tool output kept on one subagent activity.
+ *
+ * A subagent's timeline is nested inside a collapsed panel, so it is a preview
+ * of what the agent did, never the primary place its output is read. Sending
+ * every child command's full output made the history payload of an
+ * agent-heavy session grow by megabytes for content almost nobody expands.
+ */
+const MAX_SUBAGENT_ACTIVITY_CONTENT = 4000;
+
+function truncateForPreview(value: string | undefined): string | undefined {
+  if (typeof value !== 'string' || value.length <= MAX_SUBAGENT_ACTIVITY_CONTENT) {
+    return value;
+  }
+  const omitted = value.length - MAX_SUBAGENT_ACTIVITY_CONTENT;
+  return `${value.slice(0, MAX_SUBAGENT_ACTIVITY_CONTENT)}\n… ${omitted} more characters`;
+}
+
+/**
+ * Trims one subagent activity down to what its nested preview can show.
+ *
+ * Used by both provider session adapters so a Claude agent's timeline and a
+ * Codex agent's timeline cost the same to transport.
+ */
+export function truncateSubagentActivity(activity: SubagentActivity): SubagentActivity {
+  const truncatedContent = truncateForPreview(activity.content);
+  const truncatedResult = activity.toolResult
+    ? { ...activity.toolResult, content: truncateForPreview(activity.toolResult.content) }
+    : activity.toolResult;
+
+  if (truncatedContent === activity.content && truncatedResult === activity.toolResult) {
+    return activity;
+  }
+
+  return { ...activity, content: truncatedContent, toolResult: truncatedResult };
+}
+
 // ---------------------------
 //----------------- CONVERSATION HISTORY PAGINATION UTILITIES ------------
 /**
@@ -523,6 +654,22 @@ export function buildDefaultProviderCurrentActiveModel(
   };
 }
 
+/**
+ * True for a model name a provider fabricated rather than actually ran.
+ *
+ * Claude Code stamps locally-synthesized transcript rows (API-error notices,
+ * usage-limit messages) with `model: "<synthetic>"`. Angle-bracketed values are
+ * placeholders, never real model ids, so neither the active-model lookup nor
+ * the per-message model a reply is labelled with may adopt one.
+ *
+ * Used by the Claude models provider (which walks the transcript backwards for
+ * the session's model) and by the Claude sessions provider (which stamps each
+ * assistant message with the model that answered it).
+ */
+export function isPlaceholderProviderModel(model: string): boolean {
+  return model.startsWith('<') && model.endsWith('>');
+}
+
 // ---------------------------
 //----------------- WEBSOCKET PAYLOAD PARSING UTILITIES ------------
 /**
@@ -1087,6 +1234,35 @@ export function flattenPromptForWindowsShell(prompt: string): string {
 
 // ---------------------------
 //----------------- TERMINAL OUTPUT UTILITIES ------------
+/**
+ * Matches the escape sequences a CLI emits when it believes it is writing to a
+ * terminal, in the three shapes those tools actually produce:
+ * - OSC (`ESC ]` … terminated by BEL or ST), used for titles and hyperlinks.
+ * - CSI (`ESC [`, or the 8-bit `\u009B` introducer that stands in for both
+ *   bytes), used for SGR colors and cursor control.
+ * - any other ECMA-48 escape sequence: `ESC`, optional intermediate bytes
+ *   (`0x20`-`0x2F`), one final byte (`0x30`-`0x7E`), such as `ESC ( B`.
+ *
+ * OSC and CSI are listed first so their terminators are consumed by the
+ * specific alternative rather than by the generic one.
+ */
+const ANSI_ESCAPE_SEQUENCE_REGEX =
+  /\u001B\][^\u0007\u001B]*(?:\u0007|\u001B\\)|(?:\u001B\[|\u009B)[0-?]*[ -/]*[@-~]|\u001B[ -/]*[0-~]/g;
+
+/**
+ * Removes ANSI escape sequences from text captured off a CLI's stdout or
+ * stderr. Provider runtimes, session readers, and the shell WebSocket share
+ * this because every one of them forwards captured process output to a web
+ * client that renders plain text: left in, the escapes show up verbatim
+ * (`[93m[1m!`) instead of as styling.
+ *
+ * The result can be empty when the input was styling only, so callers that
+ * forward the text should re-check for emptiness after cleaning.
+ */
+export function stripAnsiSequences(value: string): string {
+  return value.replace(ANSI_ESCAPE_SEQUENCE_REGEX, '');
+}
+
 const ANSI_TERMINAL_STYLES = {
   reset: '\x1b[0m',
   bright: '\x1b[1m',

package/dist/assets/channel-_falYbU1.js

@@ -1 +0,0 @@
-import{af as o,ag as n}from"./mermaid.core-BEUL86Z6.js";const t=(a,r)=>o.lang.round(n.parse(a)[r]);export{t as c};

package/dist/assets/classDiagram-JCYQIIEL-Dn-3CfpR.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-GF5L2VYU-rrl2lRxY.js";import{_ as i}from"./mermaid.core-BEUL86Z6.js";import"./chunk-5VM5RSS4-B0rjslal.js";import"./chunk-XXDRQBXY-wHxalsXk.js";import"./chunk-KBJHAD2P-CRzKgU8S.js";import"./chunk-2GRJ4B5K-B8fnBG6E.js";import"./index-DFkBBuSA.js";import"./vendor-codemirror-OwyKSvPE.js";import"./vendor-react-BGZc9oRE.js";import"./vendor-xterm-CS4rQ5Mr.js";var c={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{c as diagram};

package/dist/assets/classDiagram-v2-OCEON4UE-Dn-3CfpR.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-GF5L2VYU-rrl2lRxY.js";import{_ as i}from"./mermaid.core-BEUL86Z6.js";import"./chunk-5VM5RSS4-B0rjslal.js";import"./chunk-XXDRQBXY-wHxalsXk.js";import"./chunk-KBJHAD2P-CRzKgU8S.js";import"./chunk-2GRJ4B5K-B8fnBG6E.js";import"./index-DFkBBuSA.js";import"./vendor-codemirror-OwyKSvPE.js";import"./vendor-react-BGZc9oRE.js";import"./vendor-xterm-CS4rQ5Mr.js";var c={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{c as diagram};