@hienlh/ppm 0.13.58 → 0.13.60

package/src/providers/claude-agent-sdk.ts

@@ -102,6 +102,10 @@ interface StreamingSession {
   meta: Session;
   query: any;
   controller: MessageController;
+  /** Latest user message content — updated on follow-ups for accurate retry */
+  lastUserContent: string;
+  /** Latest user message images — updated on follow-ups for accurate retry */
+  lastUserImages?: Array<{ data: string; mediaType: string }>;
 }
 
 /**
@@ -550,6 +554,9 @@ export class ClaudeAgentSdkProvider implements AIProvider {
       session_id: sessionId,
       priority: opts?.priority ?? 'next',
     });
+    // Track latest message for retry paths (fixes stale firstMsg bug)
+    ss.lastUserContent = content;
+    ss.lastUserImages = opts?.images;
     console.log(`[sdk] pushMessage: session=${sessionId} priority=${opts?.priority ?? 'next'}`);
   }
 
@@ -607,6 +614,9 @@ export class ClaudeAgentSdkProvider implements AIProvider {
         session_id: sessionId,
         priority: opts?.priority ?? 'next',
       });
+      // Track latest message for retry paths (fixes stale firstMsg bug)
+      existingStream.lastUserContent = message;
+      existingStream.lastUserImages = opts?.images;
       console.log(`[sdk] sendMessage follow-up: session=${sessionId} pushed to generator`);
       return; // Events flow through first-message's consumer loop
     }
@@ -864,8 +874,32 @@ export class ClaudeAgentSdkProvider implements AIProvider {
         session_id: sessionId,
       };
 
+      // Build a retry message from the LATEST user content (not the stale firstMsg).
+      // Follow-ups via pushMessage update lastUserContent on the streaming session,
+      // so retries after token refresh correctly replay the current turn.
+      // Also returns the raw content/images for re-populating the new streaming session.
+      const buildRetryMsg = () => {
+        const ss = this.streamingSessions.get(sessionId);
+        const content = ss?.lastUserContent ?? message;
+        const images = ss?.lastUserImages;
+        return {
+          msg: {
+            type: 'user' as const,
+            message: buildMessageParam(content, images),
+            parent_tool_use_id: null,
+            session_id: sessionId,
+          },
+          lastUserContent: content,
+          lastUserImages: images,
+        };
+      };
+
       const { generator: streamGen, controller: initialCtrl } = createMessageChannel();
-      initialCtrl.push(firstMsg);
+      // On crash retry, use buildRetryMsg to get the latest user message (not the stale firstMsg)
+      const initRetry = crashRetryCount > 0 ? buildRetryMsg() : null;
+      initialCtrl.push(initRetry?.msg ?? firstMsg);
+      const initContent = initRetry?.lastUserContent ?? message;
+      const initImages = initRetry?.lastUserImages ?? opts?.images;
 
       const initialQuery = query({
         prompt: streamGen,
@@ -875,7 +909,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
           canUseTool,
         } as any,
       });
-      this.streamingSessions.set(sessionId, { meta, query: initialQuery, controller: initialCtrl });
+      this.streamingSessions.set(sessionId, { meta, query: initialQuery, controller: initialCtrl, lastUserContent: initContent, lastUserImages: initImages });
       this.activeQueries.set(sessionId, initialQuery);
       let eventSource: AsyncIterable<any> = initialQuery;
       console.log(`[sdk] session=${sessionId} query() created, waiting for first SDK event...`);
@@ -924,16 +958,17 @@ export class ClaudeAgentSdkProvider implements AIProvider {
             retryCount++;
             console.warn(`[sdk] transient error on first event — retrying (attempt ${retryCount}/${MAX_RETRIES})`);
             // Close current streaming session (uses streamingSessions, not stale closure refs)
+            const retry1 = buildRetryMsg();
             closeCurrentStream();
             const { generator: retryGen, controller: retryCtrl } = createMessageChannel();
-            retryCtrl.push(firstMsg);
+            retryCtrl.push(retry1.msg);
             // Retry with resume (safe even if JSONL doesn't exist yet — SDK handles gracefully)
             const retryOpts = { ...queryOptions, sessionId: undefined, resume: sessionId };
             const rq = query({
               prompt: retryGen,
               options: { ...retryOpts, ...(permissionHooks && { hooks: permissionHooks }), canUseTool } as any,
             });
-            this.streamingSessions.set(sessionId, { meta, query: rq, controller: retryCtrl });
+            this.streamingSessions.set(sessionId, { meta, query: rq, controller: retryCtrl, lastUserContent: retry1.lastUserContent, lastUserImages: retry1.lastUserImages });
             this.activeQueries.set(sessionId, rq);
             eventSource = rq;
             continue retryLoop;
@@ -994,17 +1029,18 @@ export class ClaudeAgentSdkProvider implements AIProvider {
               authRetryCount = recovered.newRetryCount;
               account = recovered.account;
               const retryEnv = this.buildQueryEnv(meta.projectPath, account);
+              const retry2 = buildRetryMsg();
               closeCurrentStream();
               const { generator: earlyAuthGen, controller: earlyAuthCtrl } = createMessageChannel();
-              // Always re-push firstMsg — SDK needs a user message from the generator
+              // Re-push current turn's message — SDK needs a user message from the generator
               // even with resume (resume loads JSONL history, generator provides current turn)
-              earlyAuthCtrl.push(firstMsg);
+              earlyAuthCtrl.push(retry2.msg);
               const retryOpts = { ...queryOptions, sessionId: undefined, resume: sessionId, env: retryEnv };
               const rq = query({
                 prompt: earlyAuthGen,
                 options: { ...retryOpts, ...(permissionHooks && { hooks: permissionHooks }), canUseTool } as any,
               });
-              this.streamingSessions.set(sessionId, { meta, query: rq, controller: earlyAuthCtrl });
+              this.streamingSessions.set(sessionId, { meta, query: rq, controller: earlyAuthCtrl, lastUserContent: retry2.lastUserContent, lastUserImages: retry2.lastUserImages });
               this.activeQueries.set(sessionId, rq);
               eventSource = rq;
               continue retryLoop;
@@ -1151,15 +1187,16 @@ export class ClaudeAgentSdkProvider implements AIProvider {
                 authRetryCount = recovered.newRetryCount;
                 account = recovered.account;
                 const retryEnv = this.buildQueryEnv(meta.projectPath, account);
+                const retry3 = buildRetryMsg();
                 closeCurrentStream();
                 const { generator: authRetryGen, controller: authRetryCtrl } = createMessageChannel();
-                authRetryCtrl.push(firstMsg);
+                authRetryCtrl.push(retry3.msg);
                 const retryOpts = { ...queryOptions, sessionId: undefined, resume: sessionId, env: retryEnv };
                 const rq = query({
                   prompt: authRetryGen,
                   options: { ...retryOpts, ...(permissionHooks && { hooks: permissionHooks }), canUseTool } as any,
                 });
-                this.streamingSessions.set(sessionId, { meta, query: rq, controller: authRetryCtrl });
+                this.streamingSessions.set(sessionId, { meta, query: rq, controller: authRetryCtrl, lastUserContent: retry3.lastUserContent, lastUserImages: retry3.lastUserImages });
                 this.activeQueries.set(sessionId, rq);
                 eventSource = rq;
                 continue retryLoop;
@@ -1189,16 +1226,17 @@ export class ClaudeAgentSdkProvider implements AIProvider {
               yield { type: "error", message: `Rate limited. Auto-retrying in ${backoff / 1000}s... (${rateLimitRetryCount}/${MAX_RATE_LIMIT_RETRIES})` };
               await new Promise((r) => setTimeout(r, backoff));
               // Close current streaming session and recreate with (potentially new) account env.
+              const retry4 = buildRetryMsg();
               closeCurrentStream();
               const rlRetryEnv = this.buildQueryEnv(meta.projectPath, account);
               const { generator: rlRetryGen, controller: rlRetryCtrl } = createMessageChannel();
-              rlRetryCtrl.push(firstMsg);
+              rlRetryCtrl.push(retry4.msg);
               const retryOpts = { ...queryOptions, sessionId: undefined, resume: sessionId, env: rlRetryEnv };
               const rq = query({
                 prompt: rlRetryGen,
                 options: { ...retryOpts, ...(permissionHooks && { hooks: permissionHooks }), canUseTool } as any,
               });
-              this.streamingSessions.set(sessionId, { meta, query: rq, controller: rlRetryCtrl });
+              this.streamingSessions.set(sessionId, { meta, query: rq, controller: rlRetryCtrl, lastUserContent: retry4.lastUserContent, lastUserImages: retry4.lastUserImages });
               this.activeQueries.set(sessionId, rq);
               eventSource = rq;
               continue retryLoop;
@@ -1284,16 +1322,17 @@ export class ClaudeAgentSdkProvider implements AIProvider {
                 }
                 yield { type: "error", message: `Rate limited. Auto-retrying in ${backoff / 1000}s... (${rateLimitRetryCount}/${MAX_RATE_LIMIT_RETRIES})` };
                 await new Promise((r) => setTimeout(r, backoff));
+                const retry5 = buildRetryMsg();
                 closeCurrentStream();
                 const rlRetryEnv = this.buildQueryEnv(meta.projectPath, account);
                 const { generator: rlRetryGen, controller: rlRetryCtrl } = createMessageChannel();
-                rlRetryCtrl.push(firstMsg);
+                rlRetryCtrl.push(retry5.msg);
                 const retryOpts = { ...queryOptions, sessionId: undefined, resume: sessionId, env: rlRetryEnv };
                 const rq = query({
                   prompt: rlRetryGen,
                   options: { ...retryOpts, ...(permissionHooks && { hooks: permissionHooks }), canUseTool } as any,
                 });
-                this.streamingSessions.set(sessionId, { meta, query: rq, controller: rlRetryCtrl });
+                this.streamingSessions.set(sessionId, { meta, query: rq, controller: rlRetryCtrl, lastUserContent: retry5.lastUserContent, lastUserImages: retry5.lastUserImages });
                 this.activeQueries.set(sessionId, rq);
                 eventSource = rq;
                 continue retryLoop;
@@ -1312,16 +1351,17 @@ export class ClaudeAgentSdkProvider implements AIProvider {
               if (recovered) {
                 authRetryCount = recovered.newRetryCount;
                 account = recovered.account;
+                const retry6 = buildRetryMsg();
                 closeCurrentStream();
                 const retryEnv = this.buildQueryEnv(meta.projectPath, account);
                 const { generator: authRetryGen2, controller: authRetryCtrl2 } = createMessageChannel();
-                authRetryCtrl2.push(firstMsg);
+                authRetryCtrl2.push(retry6.msg);
                 const retryOpts = { ...queryOptions, sessionId: undefined, resume: sessionId, env: retryEnv };
                 const rq = query({
                   prompt: authRetryGen2,
                   options: { ...retryOpts, ...(permissionHooks && { hooks: permissionHooks }), canUseTool } as any,
                 });
-                this.streamingSessions.set(sessionId, { meta, query: rq, controller: authRetryCtrl2 });
+                this.streamingSessions.set(sessionId, { meta, query: rq, controller: authRetryCtrl2, lastUserContent: retry6.lastUserContent, lastUserImages: retry6.lastUserImages });
                 this.activeQueries.set(sessionId, rq);
                 eventSource = rq;
                 continue retryLoop;

package/src/server/middleware/auth.ts

@@ -25,12 +25,15 @@ export async function authMiddleware(c: Context, next: Next) {
     }
   }
 
-  // Fallback: ?token= query param for SSE/EventSource (can't set custom headers)
-  // Scoped to /stream paths only to avoid leaking token in logs/referer on all GET routes
-  if (c.req.method === "GET" && c.req.path.endsWith("/stream")) {
-    const queryToken = c.req.query("token");
-    if (queryToken && queryToken === authConfig.token) {
-      return next();
+  // Fallback: ?token= query param for SSE/EventSource & iframe embeds (can't set custom headers)
+  // Scoped to /stream and /files/raw paths to avoid leaking token on all GET routes
+  if (c.req.method === "GET") {
+    const p = c.req.path;
+    if (p.endsWith("/stream") || p.endsWith("/files/raw") || p === "/api/fs/raw") {
+      const queryToken = c.req.query("token");
+      if (queryToken && queryToken === authConfig.token) {
+        return next();
+      }
     }
   }
 

package/src/web/components/editor/pdf-preview.tsx

@@ -1,35 +1,36 @@
-import { useCallback, useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { Loader2, FileWarning, ExternalLink } from "lucide-react";
-import { useBlobUrl } from "./use-blob-url";
+import { projectUrl, getAuthToken } from "@/lib/api-client";
 
 export function PdfPreview({ filePath, projectName }: { filePath: string; projectName: string }) {
-  const [refreshKey, setRefreshKey] = useState(0);
   const iframeRef = useRef<HTMLIFrameElement>(null);
-  const pageHashRef = useRef("");
+  const [loaded, setLoaded] = useState(false);
+  const [error, setError] = useState(false);
 
-  const { blobUrl, error } = useBlobUrl(filePath, projectName, "application/pdf", refreshKey);
+  // Build stable direct URL (no blob) so reload() preserves scroll
+  const iframeSrc = useMemo(() => {
+    const isExternal = /^(\/|[A-Za-z]:[/\\])/.test(filePath);
+    const base = isExternal
+      ? `/api/fs/raw?path=${encodeURIComponent(filePath)}`
+      : `${projectUrl(projectName)}/files/raw?path=${encodeURIComponent(filePath)}`;
+    const token = getAuthToken();
+    return token ? `${base}&token=${encodeURIComponent(token)}` : base;
+  }, [filePath, projectName]);
 
-  // Auto-reload: listen for file:changed WS events
+  // Auto-reload on file change — reload() preserves browser PDF viewer scroll
   useEffect(() => {
     const handler = (e: Event) => {
       const detail = (e as CustomEvent).detail;
       if (detail.projectName !== projectName || detail.path !== filePath) return;
-      // Save current page hash before re-fetch (Chrome PDF viewer uses #page=N&zoom=...)
       try {
-        pageHashRef.current = iframeRef.current?.contentWindow?.location.hash || "";
-      } catch { /* cross-origin */ }
-      setRefreshKey((k) => k + 1);
+        iframeRef.current?.contentWindow?.location.reload();
+      } catch { /* cross-origin fallback — shouldn't happen for same-origin */ }
     };
     window.addEventListener("file:changed", handler);
     return () => window.removeEventListener("file:changed", handler);
   }, [filePath, projectName]);
 
-  const openInNewTab = useCallback(() => { if (blobUrl) window.open(blobUrl, "_blank"); }, [blobUrl]);
-
-  // Append saved page hash to blob URL so PDF viewer restores position
-  const iframeSrc = blobUrl
-    ? `${blobUrl}${pageHashRef.current}`
-    : undefined;
+  const openInNewTab = useCallback(() => { window.open(iframeSrc, "_blank"); }, [iframeSrc]);
 
   if (error) {
     return (
@@ -39,18 +40,27 @@ export function PdfPreview({ filePath, projectName }: { filePath: string; projec
       </div>
     );
   }
-  if (!blobUrl) {
-    return <div className="flex items-center justify-center h-full"><Loader2 className="size-5 animate-spin text-text-subtle" /></div>;
-  }
   return (
     <div className="flex flex-col h-full">
-      <div className="flex items-center justify-between px-3 py-1.5 border-b border-border bg-background shrink-0">
-        <span className="text-xs text-text-secondary truncate">{filePath}</span>
-        <button onClick={openInNewTab} className="flex items-center gap-1 text-xs text-text-secondary hover:text-text-primary transition-colors">
-          <ExternalLink className="size-3" /> Open in new tab
-        </button>
+      {!loaded && (
+        <div className="flex items-center justify-center h-full"><Loader2 className="size-5 animate-spin text-text-subtle" /></div>
+      )}
+      <div className={`flex flex-col h-full ${loaded ? "" : "hidden"}`}>
+        <div className="flex items-center justify-between px-3 py-1.5 border-b border-border bg-background shrink-0">
+          <span className="text-xs text-text-secondary truncate">{filePath}</span>
+          <button onClick={openInNewTab} className="flex items-center gap-1 text-xs text-text-secondary hover:text-text-primary transition-colors">
+            <ExternalLink className="size-3" /> Open in new tab
+          </button>
+        </div>
+        <iframe
+          ref={iframeRef}
+          src={iframeSrc}
+          title={filePath}
+          className="flex-1 w-full border-none"
+          onLoad={() => setLoaded(true)}
+          onError={() => setError(true)}
+        />
       </div>
-      <iframe ref={iframeRef} src={iframeSrc} title={filePath} className="flex-1 w-full border-none" />
     </div>
   );
 }