@hienlh/ppm 0.17.56 → 0.18.0

package/src/services/host-info/pinned-windows-quick-access.ts

@@ -0,0 +1,87 @@
+/** Windows Quick Access pinned folders via the Shell COM `Namespace`
+ *  (`shell:::{679f85cb-...}`), verified live: ~150ms enumeration, and
+ *  `System.Home.IsPinned` reliably separates pinned entries from "frequent"
+ *  ones. Shell COM reports `.zip`/`.rar` archives as `IsFolder=true`, so
+ *  every candidate is re-checked with a real directory stat before it ships. */
+import * as fsp from "node:fs/promises";
+import type { PinnedFolder } from "../../types/system.ts";
+import { defaultRunner, type Runner } from "./spawn-runner.ts";
+
+export interface QuickAccessDeps {
+  run: Runner;
+  isDirectory: (path: string) => Promise<boolean>;
+}
+
+const defaultDeps: QuickAccessDeps = {
+  run: defaultRunner,
+  isDirectory: async (p) => {
+    try {
+      return (await fsp.stat(p)).isDirectory();
+    } catch {
+      return false;
+    }
+  },
+};
+
+// `@($result)` forces an array even for 0/1 items — ConvertTo-Json unwraps a
+// single-element pipeline input into a bare object otherwise.
+const QUICK_ACCESS_SCRIPT = `
+$items = (New-Object -ComObject Shell.Application).Namespace('shell:::{679f85cb-0220-4080-b29b-5540cc05aab6}').Items()
+$result = foreach ($i in $items) {
+  if ($i.IsFolder) {
+    [PSCustomObject]@{ Name = $i.Name; Path = $i.Path; Pinned = $i.ExtendedProperty('System.Home.IsPinned') }
+  }
+}
+$arr = @($result)
+$json = $arr | ConvertTo-Json -Compress
+if ($arr.Count -le 1) { $json = '[' + $json + ']' }
+Write-Output $json
+`.trim();
+
+interface RawItem {
+  Name?: string;
+  Path?: string;
+  Pinned?: boolean | string | null;
+}
+
+function isPinned(v: RawItem["Pinned"]): boolean {
+  return v === true || v === "True" || v === "true";
+}
+
+/** Read Quick Access pinned folders, appending any failure to the shared `warnings` array (never throws). */
+export async function getWindowsQuickAccessPinned(
+  warnings: string[],
+  overrides: Partial<QuickAccessDeps> = {},
+): Promise<PinnedFolder[]> {
+  const deps: QuickAccessDeps = { ...defaultDeps, ...overrides };
+  try {
+    const res = await deps.run(
+      ["powershell.exe", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", QUICK_ACCESS_SCRIPT],
+      5000,
+    );
+    if (res.timedOut || res.code !== 0) {
+      warnings.push(`pinned: Quick Access ${res.timedOut ? "timed out" : `exited ${res.code}`}`);
+      return [];
+    }
+
+    let raw: RawItem[];
+    try {
+      const parsed = JSON.parse(res.stdout.trim() || "[]");
+      raw = (Array.isArray(parsed) ? parsed : [parsed]).filter((x): x is RawItem => x != null);
+    } catch (e) {
+      warnings.push(`pinned: Quick Access JSON parse failed (${(e as Error)?.message ?? e})`);
+      return [];
+    }
+
+    const pinned: PinnedFolder[] = [];
+    for (const item of raw) {
+      if (!item.Name || !item.Path || !isPinned(item.Pinned)) continue;
+      if (!(await deps.isDirectory(item.Path))) continue; // drops archive-as-folder (.zip/.rar) and stale entries
+      pinned.push({ name: item.Name, path: item.Path, source: "quick-access" });
+    }
+    return pinned;
+  } catch (e) {
+    warnings.push(`pinned: Quick Access failed (${(e as Error)?.message ?? e})`);
+    return [];
+  }
+}

package/src/services/host-info/spawn-runner.ts

@@ -0,0 +1,41 @@
+/** Shared argv-array shell-out for host-info providers. Every provider that
+ *  needs PowerShell/plutil/findmnt/xdg-user-dir injects a `Runner` so unit
+ *  tests never spawn a real process — only `defaultRunner` touches `Bun.spawn`. */
+export interface RunResult {
+  stdout: string;
+  stderr: string;
+  /** Process exit code, or null when killed by the timeout. */
+  code: number | null;
+  timedOut: boolean;
+}
+
+export type Runner = (argv: string[], timeoutMs?: number) => Promise<RunResult>;
+
+const DEFAULT_TIMEOUT_MS = 5000;
+
+/** Real implementation: argv array only (never string-interpolated into a shell), bounded by timeoutMs. */
+export const defaultRunner: Runner = async (argv, timeoutMs = DEFAULT_TIMEOUT_MS) => {
+  const proc = Bun.spawn(argv, { stdout: "pipe", stderr: "pipe", stdin: "ignore", windowsHide: true });
+  let timedOut = false;
+  const killTimer = setTimeout(() => {
+    timedOut = true;
+    try {
+      proc.kill();
+    } catch {
+      // Process already exited between the timer firing and the kill call.
+    }
+  }, timeoutMs);
+
+  try {
+    const [stdout, stderr, code] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ]);
+    return { stdout, stderr, code, timedOut };
+  } catch (e: any) {
+    return { stdout: "", stderr: e?.message ?? String(e), code: null, timedOut };
+  } finally {
+    clearTimeout(killTimer);
+  }
+};

package/src/services/jsonl-transcript-parser.ts

@@ -279,6 +279,12 @@ export async function parseJsonlTranscript(
   // messages than the Agent tool_use that spawned it.
   nestChildEventsAcrossMessages(merged);
 
+  // Newer CLIs keep subagent transcripts in <session-dir>/subagents/ instead
+  // of inline sidechain lines — merge them back as Agent card children.
+  // Lazy import: merger depends on this module (parseSessionMessage).
+  const { mergeSubagentChildren } = await import("./subagent-transcript-merger.ts");
+  mergeSubagentChildren(filePath.replace(/\.jsonl$/, ""), merged);
+
   return merged.filter(
     (msg) => msg.content.trim().length > 0 || (msg.events && msg.events.length > 0),
   );

package/src/services/sqlite-types.ts

@@ -0,0 +1,26 @@
+/** Shapes returned by the SQLite viewer service, shared by both of its doors. */
+
+export interface TableInfo {
+  name: string;
+  rowCount: number;
+}
+
+export interface ColumnInfo {
+  cid: number;
+  name: string;
+  type: string;
+  notnull: boolean;
+  pk: boolean;
+  dflt_value: string | null;
+  fk: { table: string; column: string } | null;
+}
+
+export interface QueryResult {
+  columns: string[];
+  rows: Record<string, unknown>[];
+  rowsAffected: number;
+  changeType: "select" | "modify";
+  executionTimeMs: number;
+  /** True when a row cap cut the result short. */
+  truncated?: boolean;
+}

package/src/services/sqlite.service.ts

@@ -1,29 +1,14 @@
 import { Database } from "bun:sqlite";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
+import { isPpmDirPath } from "./fs-path-guard.service.ts";
+import { assertNoAttachStatement } from "./fs-ops/sql-statement-guard.ts";
+import { readRows } from "./fs-ops/sql-row-reader.ts";
 
-export interface TableInfo {
-  name: string;
-  rowCount: number;
-}
-
-export interface ColumnInfo {
-  cid: number;
-  name: string;
-  type: string;
-  notnull: boolean;
-  pk: boolean;
-  dflt_value: string | null;
-  fk: { table: string; column: string } | null;
-}
+import type { ColumnInfo, QueryResult, TableInfo } from "./sqlite-types.ts";
 
-export interface QueryResult {
-  columns: string[];
-  rows: Record<string, unknown>[];
-  rowsAffected: number;
-  changeType: "select" | "modify";
-  executionTimeMs: number;
-}
+// Re-exported so existing importers keep using the service as one entry point.
+export type { ColumnInfo, QueryResult, TableInfo };
 
 /** Auto-close idle databases after 5 minutes */
 const IDLE_TIMEOUT_MS = 5 * 60 * 1000;
@@ -36,12 +21,24 @@ interface CachedDb {
 class SqliteService {
   private cache = new Map<string, CachedDb>();
 
-  /** Resolve db path — supports both project-relative and absolute paths */
+  /**
+   * Resolve db path — supports both project-relative and absolute paths.
+   *
+   * Absolute paths are not probed with `existsSync`: they come from the
+   * filesystem door, which can point at a dead network mount and would block
+   * the event loop here. That door stats the file asynchronously before
+   * calling in, and `open()` refuses to create a missing database, so nothing
+   * is silently brought into existence either way.
+   */
   private resolvePath(projectPath: string, dbRelPath: string): string {
     const isAbsolute = /^(\/|[A-Za-z]:[/\\])/.test(dbRelPath);
     const abs = isAbsolute ? dbRelPath : resolve(projectPath, dbRelPath);
     if (!isAbsolute && !abs.startsWith(projectPath)) throw new Error("Access denied: path outside project");
-    if (!existsSync(abs)) throw new Error(`Database not found: ${dbRelPath}`);
+    // The PPM directory holds the config database with provider credentials and
+    // the auth token. Absolute paths are accepted here, so this door has to
+    // refuse it explicitly or a viewer could read the whole secret store.
+    if (isPpmDirPath(resolve(abs))) throw new Error("Access denied: PPM directory is not browsable");
+    if (!isAbsolute && !existsSync(abs)) throw new Error(`Database not found: ${dbRelPath}`);
     return abs;
   }
 
@@ -53,7 +50,11 @@ class SqliteService {
       cached.timer = setTimeout(() => this.close(absPath), IDLE_TIMEOUT_MS);
       return cached.db;
     }
-    const db = new Database(absPath);
+    // `create: false` — a viewer must never bring a database file into
+    // existence, least of all at a path the caller chose. `readwrite` has to
+    // be spelled out alongside it: the two flags are passed straight to
+    // sqlite3_open_v2, which rejects the combination that omits it.
+    const db = new Database(absPath, { readwrite: true, create: false });
     db.exec("PRAGMA journal_mode = WAL");
     // SQLite defaults FK enforcement off per connection, which would let the
     // viewer delete rows other clients reject and leave orphaned children.
@@ -122,8 +123,13 @@ class SqliteService {
     return { columns, rows, total, page, limit };
   }
 
-  /** Execute arbitrary SQL */
-  executeQuery(projectPath: string, dbPath: string, sql: string): QueryResult {
+  /**
+   * Execute arbitrary SQL. `maxRows` caps a SELECT result — a foreign database
+   * opened through the filesystem door can be arbitrarily large, and reading
+   * every row into memory to answer one request is a denial of service.
+   */
+  executeQuery(projectPath: string, dbPath: string, sql: string, maxRows?: number): QueryResult {
+    assertNoAttachStatement(sql);
     const abs = this.resolvePath(projectPath, dbPath);
     const db = this.open(abs);
     const trimmed = sql.trim().toUpperCase();
@@ -132,11 +138,13 @@ class SqliteService {
 
     const start = performance.now();
     if (isSelect) {
-      const stmt = db.query(sql);
-      const rows = stmt.all() as Record<string, unknown>[];
+      const { rows, truncated } = readRows(db.query(sql), maxRows);
       const executionTimeMs = Math.round(performance.now() - start);
       const columns = rows.length > 0 ? Object.keys(rows[0]!) : [];
-      return { columns, rows, rowsAffected: 0, changeType: "select", executionTimeMs };
+      return {
+        columns, rows, rowsAffected: 0, changeType: "select", executionTimeMs,
+        ...(truncated ? { truncated: true } : {}),
+      };
     }
 
     const result = db.run(sql);
@@ -146,6 +154,7 @@ class SqliteService {
 
   /** Execute multi-statement SQL script (no result rows returned) */
   executeScript(projectPath: string, dbPath: string, sql: string): { executionTimeMs: number } {
+    assertNoAttachStatement(sql);
     const abs = this.resolvePath(projectPath, dbPath);
     const db = this.open(abs);
     const start = performance.now();

package/src/services/subagent-transcript-merger.ts

@@ -0,0 +1,144 @@
+/**
+ * SubagentTranscriptMerger — restore Agent/Task card children on reload.
+ *
+ * Newer Claude Code CLIs no longer write subagent activity into the main
+ * session JSONL (no isSidechain lines, no parent_tool_use_id). Instead each
+ * agent gets its own transcript at:
+ *   ~/.claude/projects/<slug>/<sessionId>/subagents/agent-<id>.jsonl
+ * with a sibling agent-<id>.meta.json carrying the spawning Agent tool_use id.
+ *
+ * Without merging these, a reloaded session shows bare Agent cards and the
+ * live-streamed children are lost. This module reads the meta files, parses
+ * each agent transcript, and attaches its events as the card's children.
+ */
+
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { ChatEvent } from "../types/chat.ts";
+import { parseSessionMessage } from "./jsonl-transcript-parser.ts";
+
+/**
+ * Locate the per-session directory (…/projects/<slug>/<sessionId>) that holds
+ * subagents/. The SDK encodes the cwd by replacing separators + drive colon
+ * with "-"; when that drifts (drive-letter case), fall back to scanning
+ * project dirs for the session's main JSONL.
+ */
+export function resolveSessionDir(sessionId: string, projectPath: string | null | undefined): string | null {
+  const home = homedir();
+  const projectsRoot = join(home, ".claude", "projects");
+  if (projectPath) {
+    const encoded = projectPath.replace(/[/\\:]/g, "-");
+    const dir = join(projectsRoot, encoded);
+    if (existsSync(join(dir, `${sessionId}.jsonl`))) return join(dir, sessionId);
+  }
+  try {
+    for (const entry of readdirSync(projectsRoot)) {
+      if (existsSync(join(projectsRoot, entry, `${sessionId}.jsonl`))) {
+        return join(projectsRoot, entry, sessionId);
+      }
+    }
+  } catch {
+    /* projects root unreadable */
+  }
+  return null;
+}
+
+interface MessageLike {
+  content: string;
+  events?: ChatEvent[];
+}
+
+/** Payload guards — a session can hold dozens of agents with multi-MB transcripts. */
+const MAX_CHILDREN_PER_AGENT = 2000;
+const MAX_CHILD_OUTPUT_CHARS = 50_000;
+
+/** Map of Agent-card toolUseId → agent transcript path, from subagents/*.meta.json */
+function indexAgentTranscripts(subagentsDir: string): Map<string, string> {
+  const map = new Map<string, string>();
+  let entries: string[];
+  try {
+    entries = readdirSync(subagentsDir);
+  } catch {
+    return map;
+  }
+  for (const name of entries) {
+    if (!name.endsWith(".meta.json")) continue;
+    try {
+      const meta = JSON.parse(readFileSync(join(subagentsDir, name), "utf8"));
+      const toolUseId = meta?.toolUseId as string | undefined;
+      if (!toolUseId) continue;
+      const transcript = join(subagentsDir, name.replace(/\.meta\.json$/, ".jsonl"));
+      if (existsSync(transcript)) map.set(toolUseId, transcript);
+    } catch {
+      /* unreadable meta — skip this agent */
+    }
+  }
+  return map;
+}
+
+/** Parse one agent transcript into a flat children event list (stream order). */
+function parseAgentTranscript(filePath: string): ChatEvent[] {
+  const children: ChatEvent[] = [];
+  let text: string;
+  try {
+    text = readFileSync(filePath, "utf8");
+  } catch {
+    return children;
+  }
+  let isFirstUser = true;
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let entry: any;
+    try {
+      entry = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (entry.type !== "user" && entry.type !== "assistant") continue;
+    if (!entry.message) continue;
+    if (children.length >= MAX_CHILDREN_PER_AGENT) break;
+    // The first user record is the agent's spawn prompt — the live stream
+    // never showed it as a child, so skip it to match the streaming view.
+    if (entry.type === "user" && isFirstUser) {
+      isFirstUser = false;
+      const content = entry.message?.content;
+      const hasToolResult = Array.isArray(content) && content.some((b: any) => b?.type === "tool_result");
+      if (!hasToolResult) continue;
+    }
+    const parsed = parseSessionMessage(entry);
+    for (const ev of parsed.events ?? []) {
+      // Keep single events from ballooning the history payload (agent files
+      // can carry multi-MB tool outputs the live stream also showed in full,
+      // but 24 agents × full outputs breaks mobile reloads).
+      if (ev.type === "tool_result" && typeof ev.output === "string" && ev.output.length > MAX_CHILD_OUTPUT_CHARS) {
+        ev.output = ev.output.slice(0, MAX_CHILD_OUTPUT_CHARS) + "\n… [truncated]";
+      }
+      children.push(ev);
+    }
+  }
+  return children;
+}
+
+/**
+ * Attach subagent transcript events as children of their Agent/Task cards.
+ * `sessionDir` is the per-session directory next to the main JSONL
+ * (…/projects/<slug>/<sessionId>). Existing children are replaced — the disk
+ * transcript is the complete record, while live-collected children may be a
+ * partial overlap. Mutates messages in-place.
+ */
+export function mergeSubagentChildren(sessionDir: string, messages: MessageLike[]): void {
+  const index = indexAgentTranscripts(join(sessionDir, "subagents"));
+  if (index.size === 0) return;
+
+  for (const msg of messages) {
+    for (const ev of msg.events ?? []) {
+      if (ev.type !== "tool_use" || (ev.tool !== "Agent" && ev.tool !== "Task") || !ev.toolUseId) continue;
+      const transcript = index.get(ev.toolUseId);
+      if (!transcript) continue;
+      const children = parseAgentTranscript(transcript);
+      if (children.length > 0) ev.children = children;
+    }
+  }
+}

package/src/types/system.ts

@@ -0,0 +1,50 @@
+/** Server-side host facts the frontend cannot learn on its own: OS, path
+ *  separator, home dir, drives/volumes, resolved known folders, and the
+ *  user's OS-pinned folders (Windows Quick Access, Finder Favorites,
+ *  GTK/KDE bookmarks). Backs `GET /api/system/host`. */
+export interface HostInfo {
+  platform: "win32" | "darwin" | "linux";
+  sep: "\\" | "/";
+  homedir: string;
+  hostname: string;
+  drives: Drive[];
+  knownFolders: KnownFolder[];
+  pinned: PinnedFolder[];
+  /** Non-fatal provider failures — a failure never becomes a 500, it becomes text here. */
+  warnings: string[];
+}
+
+export type DriveKind = "fixed" | "removable" | "network" | "unknown";
+
+export interface Drive {
+  /** Display label for the mount, e.g. "C:" or "Macintosh HD". */
+  name: string;
+  /** Filesystem path to browse into, e.g. "C:\\" or "/Volumes/External". */
+  path: string;
+  kind: DriveKind;
+  /** Volume label when the OS reports one (Windows CIM `VolumeName`). */
+  label?: string;
+}
+
+export type KnownFolderKey =
+  | "desktop"
+  | "documents"
+  | "downloads"
+  | "pictures"
+  | "music"
+  | "videos"
+  | "icloud";
+
+export interface KnownFolder {
+  key: KnownFolderKey;
+  name: string;
+  path: string;
+}
+
+export type PinnedSource = "quick-access" | "finder-favorites" | "gtk" | "kde";
+
+export interface PinnedFolder {
+  name: string;
+  path: string;
+  source: PinnedSource;
+}

package/src/web/app.tsx

@@ -1,10 +1,11 @@
-import { useEffect, useState, useCallback, useRef } from "react";
+import { useEffect, useState, useCallback, useRef, lazy, Suspense } from "react";
 import { Toaster } from "@/components/ui/sonner";
 import { TooltipProvider } from "@/components/ui/tooltip";
 import { PanelLayout } from "@/components/layout/panel-layout";
 import { TabPool } from "@/components/layout/tab-pool";
 import { Sidebar } from "@/components/layout/sidebar";
 import { StatusBar } from "@/components/layout/status-bar";
+import { WindowLayer } from "@/components/floating-window/window-layer";
 import { MobileNav } from "@/components/layout/mobile-nav";
 import { MobileDrawer } from "@/components/layout/mobile-drawer";
 import { ProjectBottomSheet } from "@/components/layout/project-bottom-sheet";
@@ -36,6 +37,13 @@ import { useExtensionWs } from "@/hooks/use-extension-ws";
 import { useIsMobile } from "@/hooks/use-is-mobile";
 import { cn } from "@/lib/utils";
 
+// Lazy: the explorer feature (views, actions, skins, icon map) is the same heavy bundle the
+// desktop floating window already keeps out of the initial chunk (see `WINDOW_CONTENT`) —
+// a static import here would pull all of it into every user's boot, mobile or not.
+const MobileExplorerSheet = lazy(() =>
+  import("@/components/os-explorer/mobile/mobile-explorer-sheet").then((m) => ({ default: m.MobileExplorerSheet })),
+);
+
 type AuthState = "checking" | "authenticated" | "unauthenticated";
 
 export function App() {
@@ -284,8 +292,9 @@ export function App() {
           {/* Desktop unified nav rail (wordmark + project switcher + section rail + panel) */}
           <Sidebar />
 
-          {/* Content area — keep-alive per project */}
-          <div className="flex-1 flex flex-col overflow-hidden">
+          {/* Content area — keep-alive per project. `relative` is the positioning context
+              the floating window layer measures and clamps its windows against. */}
+          <div className="relative flex-1 flex flex-col overflow-hidden">
             {[...mountedProjects].map((projectName) => (
               <div
                 key={projectName}
@@ -303,6 +312,8 @@ export function App() {
             {/* Desktop status bar — spans the working area only (not under the sidebar).
                 Self-gated to desktop via `hidden md:flex`. */}
             <StatusBar />
+            {/* Floating windows — desktop only, self-gated; covers the working area. */}
+            <WindowLayer />
           </div>
         </div>
 
@@ -331,6 +342,11 @@ export function App() {
         {/* Compare Files picker (Mod+Alt+D, palette, context menus) — singleton */}
         <ComparePicker />
 
+        {/* Mobile full-screen file explorer sheet — lazy + self-gated, loads nothing until opened */}
+        <Suspense fallback={null}>
+          <MobileExplorerSheet />
+        </Suspense>
+
         {/* Global bug report popup */}
         <BugReportPopup />
 

package/src/web/components/editor/code-editor.tsx

@@ -19,6 +19,9 @@ import { useConnections, type Connection } from "../database/use-connections";
 import { GlideDataGrid } from "../database/glide-data-grid";
 import type { GridColumnSchema } from "../database/glide-grid-types";
 import type { DbQueryResult } from "../database/use-database";
+// Single source of truth: the explorer decides whether a double-click can open a file at
+// all from these very sets, so they must not be redeclared here.
+import { AUDIO_EXTS, IMAGE_EXTS, SQLITE_EXTS, VIDEO_EXTS } from "@/components/os-explorer/can-open-in-ppm";
 
 const MarkdownRenderer = lazy(() =>
   import("@/components/shared/markdown-renderer").then((m) => ({ default: m.MarkdownRenderer }))
@@ -30,15 +33,6 @@ const VideoPreview = lazy(() => import("./video-preview").then((m) => ({ default
 const AudioPreview = lazy(() => import("./audio-preview").then((m) => ({ default: m.AudioPreview })));
 const DocxPreview = lazy(() => import("./docx-preview").then((m) => ({ default: m.DocxPreview })));
 
-/** Image extensions renderable inline */
-const IMAGE_EXTS = new Set(["png", "jpg", "jpeg", "gif", "webp", "svg", "ico"]);
-/** Video extensions playable inline */
-const VIDEO_EXTS = new Set(["mp4", "webm", "mov", "ogg", "avi", "mkv"]);
-/** Audio extensions playable inline */
-const AUDIO_EXTS = new Set(["mp3", "wav", "flac", "aac", "m4a", "wma"]);
-/** SQLite extensions — redirect to sqlite viewer */
-const SQLITE_EXTS = new Set(["db", "sqlite", "sqlite3"]);
-
 function getFileExt(filename: string): string {
   return filename.split(".").pop()?.toLowerCase() ?? "";
 }