@kabmo-labs/kabmo 0.0.0-stage → 0.0.1

package/src/server/routes/chat/stream.test.ts

@@ -0,0 +1,102 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The simulated stream reports through the SAME row a real run does.
+ *
+ * The sidebar spinner and the chat's generating indicator read one source —
+ * the server's `stream` row — so the MOCK path has to write it or the two
+ * surfaces disagree about whether anything is happening. Two failure modes are
+ * pinned here, and both were real:
+ *
+ * - the row was never written at all (`loadSidebarStatus` returned `{}` under
+ *   `MOCK=true`), so the indicator had no server answer to read;
+ * - the row was written but this process held no RPC run for it, so the
+ *   sidebar's self-heal judged it an ORPHAN and cleared the spinner
+ *   mid-answer. That is what the `localRuns` claim exists to prevent.
+ *
+ * The stream is aborted after its first frame rather than drained: the
+ * simulated turn is ~15s of real timers, and the terminal write is the same
+ * `finally` either way. Every assertion waits on the write's own realtime
+ * signal, never a sleep.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { loadStreamStatuses } from '@/shared/lib/omp/session/stream-state.server';
+import { getLiveRunSessionIds } from '@/server/lib/omp/rpc/session-registry';
+import { localRuns } from '@/server/lib/omp/session/local-runs.server';
+import { onRealtimeSignal } from '@/server/lib/realtime/signals.server';
+import { isolateDb, releaseDb } from '@/test-support/isolated-db';
+import { action } from '@/server/routes/chat/stream';
+
+const savedMock = Bun.env.MOCK;
+
+beforeEach(() => {
+  isolateDb();
+  localRuns().clear();
+  Bun.env.MOCK = 'true';
+});
+
+afterEach(() => {
+  Bun.env.MOCK = savedMock;
+  localRuns().clear();
+  releaseDb();
+});
+
+/** Resolve on the next `stream-status` write — the write's own signal. */
+function nextStreamStatusWrite(): Promise<void> {
+  const { promise, resolve } = Promise.withResolvers<void>();
+  const off = onRealtimeSignal((event) => {
+    if (event.signal !== 'stream-status') return;
+    off();
+    resolve();
+  });
+  return promise;
+}
+
+describe('simulated stream status', () => {
+  test('a simulated run claims the row and reports a terminal badge', async () => {
+    const abort = new AbortController();
+    const request = new Request('http://localhost/api/chat/stream', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ sessionId: 'sim-1', prompt: 'hello' }),
+      signal: abort.signal,
+    });
+
+    // Armed BEFORE the request: the live row is written at stream start.
+    const liveWrite = nextStreamStatusWrite();
+    const response = await action({ request, params: {} });
+    expect(response.status).toBe(200);
+    const reader = response.body!.getReader();
+    await reader.read();
+    await liveWrite;
+
+    expect((await loadStreamStatuses())['sim-1']).toBe('stream');
+    // The claim is what keeps the sidebar's self-heal from reading this row as
+    // an orphan: no omp child exists behind it.
+    expect(getLiveRunSessionIds().has('sim-1')).toBe(true);
+
+    // Abort: the run's terminal write is the same one a natural end performs.
+    const terminalWrite = nextStreamStatusWrite();
+    abort.abort();
+    for (;;) {
+      const { done } = await reader.read();
+      if (done) break;
+    }
+    await terminalWrite;
+
+    expect((await loadStreamStatuses())['sim-1']).toBe('abort');
+    // Released with the run, or the next heal would keep a dead session "live".
+    expect(getLiveRunSessionIds().has('sim-1')).toBe(false);
+  }, 20_000);
+
+  test('real mode refuses the simulated path outright', async () => {
+    Bun.env.MOCK = 'false';
+    const request = new Request('http://localhost/api/chat/stream', { method: 'POST' });
+    const response = await action({ request, params: {} });
+    expect(response.status).toBe(400);
+  });
+});

package/src/server/routes/chat/stream.ts

@@ -0,0 +1,111 @@
+import type { ActionFunctionArgs, LoaderFunctionArgs } from '@/server/lib/remix-compat';
+import { isMockMode } from '@/server/mock.server';
+import { handleSimulatedStreaming } from '@/shared/lib/chat/stream-service';
+import { createSseStream } from '@/server/lib/sse';
+import { markStreamStatus } from '@/shared/lib/omp/session/stream-state.server';
+import { localRuns } from '@/server/lib/omp/session/local-runs.server';
+
+export async function loader({ request }: LoaderFunctionArgs) {
+  return handleStreamingRequest(request);
+}
+
+export async function action({ request }: ActionFunctionArgs) {
+  return handleStreamingRequest(request);
+}
+
+async function handleStreamingRequest(request: Request) {
+  const url = new URL(request.url);
+  let sessionId = url.searchParams.get('sessionId') || `session-${Date.now()}`;
+  let prompt = url.searchParams.get('prompt') || '';
+  let modelName = url.searchParams.get('model') || 'DeepSeek V4 Pro';
+  let workspaceName = url.searchParams.get('workspaceName') || 'Workspace';
+
+  if (request.method === 'POST') {
+    try {
+      const body = await request.json();
+      if (body.sessionId) sessionId = body.sessionId;
+      if (body.prompt) prompt = body.prompt;
+      if (body.model) modelName = body.model;
+      if (body.workspaceName) workspaceName = body.workspaceName;
+    } catch {
+      // Use fallback query params if JSON parsing fails
+    }
+  }
+
+  // Real mode routes through the omp agent RPC bridge (POST /api/agent/:id +
+  // SSE /api/agent/:id/events). This simulated stream is the MOCK-only
+  // path — refuse it in real mode so the two never conflict.
+  if (!isMockMode()) {
+    return new Response(JSON.stringify({ error: 'Streaming is handled by the omp agent bridge in real mode' }), {
+      status: 400,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+
+  const stream = createSseStream({
+    headers: { 'Cache-Control': 'no-cache, no-transform', 'X-Accel-Buffering': 'no' },
+    async onStart(handlers) {
+      let isAborted = false;
+      const abortListener = () => {
+        isAborted = true;
+      };
+      request.signal.addEventListener('abort', abortListener);
+
+      const sendEvent = (event: string, data: unknown): void => {
+        if (isAborted) return;
+        handlers.send(event, data);
+        if (handlers.isClosed()) isAborted = true;
+      };
+
+      // A simulated run is a run all the same, and it reports through the SAME
+      // row a real one does — the sidebar spinner and the chat's generating
+      // indicator read one source, so this path must write it or the two
+      // surfaces disagree about whether anything is happening. `localRuns`
+      // claims it for this process, because there is no omp child behind it for
+      // the registry to find: without the claim the sidebar's self-heal reads
+      // the row as an orphan and clears the spinner mid-answer.
+      localRuns().add(sessionId);
+      void markStreamStatus(sessionId, 'stream');
+
+      try {
+        const timeStr = new Date().toLocaleTimeString('en-US', { hour: '2-digit', minute: '2-digit' });
+        const messageId = `msg-${Date.now()}-ai`;
+
+        // 1. Send initialization event
+        sendEvent('init', {
+          id: messageId,
+          role: 'ai',
+          date: `Today, ${timeStr}`,
+          timestamp: timeStr,
+          model: modelName,
+        });
+
+        // Simulated intelligent streaming — the MOCK-only path for Kabmo.
+        await handleSimulatedStreaming({
+          prompt,
+          modelName,
+          workspaceName,
+          sessionId,
+          messageId,
+          timeStr,
+          sendEvent,
+          isAborted: () => isAborted,
+        });
+      } catch (err: unknown) {
+        if (!isAborted) {
+          const message = err instanceof Error ? err.message : 'Streaming execution error';
+          sendEvent('error', { error: message });
+        }
+      } finally {
+        request.signal.removeEventListener('abort', abortListener);
+        // Terminal badge, not a deletion: opening the session acknowledges it,
+        // exactly as it does for a real run. An aborted stream is `abort`.
+        void markStreamStatus(sessionId, isAborted ? 'abort' : 'finish');
+        localRuns().delete(sessionId);
+        handlers.close();
+      }
+    },
+  });
+
+  return stream.response;
+}

package/src/server/routes/chat/turns.ts

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Full-history user-turn index for the timeline jump rail.
+ *
+ * The timeline only mounts a window of a long session (the newest 120 messages
+ * plus whatever "Load earlier messages" pulled in), so a rail built from the
+ * mounted rows shows a fraction of the conversation and cannot reach a turn
+ * that was never paged in. This endpoint answers the same id/position question
+ * the timeline does — the JSONL messages with Kabmo DB overlay merged —
+ * but for the WHOLE session, and strips each row down to what a tick needs.
+ *
+ * Positions are indices into that full merged list, which is exactly the list
+ * `GET /api/chat/:sessionId` pages through with `?before=`: a rail click pages
+ * windows from that index until the target row is mounted, so the cursor the
+ * rail carries is the same coordinate space the loader uses.
+ */
+
+import { json } from '@/server/lib/remix-compat';
+import type { LoaderFunctionArgs } from '@/server/lib/remix-compat';
+import { getDb } from '@/server/db.server';
+import { getSessionData } from '@/client/data/mock/chat';
+import { isMockMode } from '@/server/mock.server';
+import { findSessionFileById } from '@/server/lib/omp/session/locator';
+import { loadSessionMessages } from '@/server/lib/omp/session/messages';
+import { mergeOmpAttachments } from '@/server/lib/omp/session/merge-stored';
+import { TURN_PREVIEW_CHARS } from '@/shared/lib/chat/timeline/turns';
+import type { UserTurnRef } from '@/shared/types/chat';
+
+/** One rail entry per user row: its id (the DOM jump target), its position in
+ *  the full list (the paging cursor), and enough text for the tooltip. */
+function toUserTurns(messages: Array<{ id?: string; role?: string; content?: string; date?: string; timestamp?: string }>): UserTurnRef[] {
+  const turns: UserTurnRef[] = [];
+  messages.forEach((message, index) => {
+    if (message?.role !== 'user') return;
+    const content = typeof message.content === 'string' ? message.content : '';
+    turns.push({
+      id: typeof message.id === 'string' && message.id ? message.id : `turn-${index}`,
+      index,
+      preview: content.slice(0, TURN_PREVIEW_CHARS),
+      date: message.date,
+      timestamp: message.timestamp,
+    });
+  });
+  return turns;
+}
+
+export async function loader({ params }: LoaderFunctionArgs) {
+  const { sessionId } = params;
+  if (!sessionId) return json({ error: 'Session ID is required' }, { status: 400 });
+
+  const mock = isMockMode();
+  try {
+    if (!mock) {
+      const filePath = await findSessionFileById(sessionId);
+      if (filePath) {
+        const messages = await loadSessionMessages(filePath);
+        const db = await getDb();
+        const overlay = await db.get('SELECT messages FROM chat_sessions WHERE session_id = ?', [sessionId]);
+        const overlaid = mergeOmpAttachments(messages, overlay?.messages);
+        return json({ turns: toUserTurns(overlaid), total: overlaid.length, source: 'omp-jsonl' });
+      }
+    }
+
+    // Kabmo-created sessions (mock or synthetic ids) answer from the DB copy,
+    // mirroring the timeline loader's fallback.
+    const db = await getDb();
+    const existing = await db.get('SELECT messages FROM chat_sessions WHERE session_id = ?', [sessionId]);
+    let messages: unknown[] = [];
+    if (existing?.messages) {
+      try {
+        const parsed: unknown = JSON.parse(existing.messages);
+        if (Array.isArray(parsed)) messages = parsed;
+      } catch {
+        messages = [];
+      }
+    } else if (mock) {
+      messages = getSessionData(sessionId)?.messages ?? [];
+    }
+    return json({ turns: toUserTurns(messages as Array<{ role?: string; content?: string }>), total: messages.length, source: mock ? 'mock' : 'db' });
+  } catch (error: unknown) {
+    return json({ error: error instanceof Error ? error.message : String(error) }, { status: 500 });
+  }
+}

package/src/server/routes/console/index.ts

@@ -0,0 +1,18 @@
+import { bindingsFor, type HandlerBinding } from '@/server/lib/route-adapter';
+import * as consoleRestart from '@/server/routes/console/restart';
+
+/**
+ * `/api/console/*` — operations on the console itself rather than on omp.
+ *
+ * A restart belongs here and not under `/api/omp/*`: it replaces the process
+ * serving this page, not an omp child.
+ *
+ * `restart` was `/api/chamber/restart` before the rename, and that path is
+ * still mounted (see `chamberBindings`) because a page loaded from an older
+ * build keeps posting to it until it reloads. The handler is the SAME function,
+ * so the two paths cannot drift into different behaviour; the old one is a
+ * compatibility mount, not a second implementation.
+ */
+export const consoleBindings: HandlerBinding[] = [
+  ...bindingsFor(consoleRestart, '/api/console/restart'),
+];

package/src/server/routes/console/restart.test.ts

@@ -0,0 +1,98 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * `POST /api/console/restart` — the settings sidebar's Restart button.
+ *
+ * The route can end the process serving the request, so its contract is pinned
+ * where it can be exercised without arming one: the verb check, the MOCK
+ * refusal (a demo must not take a server down), and the refusal an instance the
+ * CLI does not own gets — which is the only branch that answers without
+ * spawning a detached `kabmo restart`. The armed branch is pinned in
+ * `lifecycle/restart.test.ts` through the decision it makes.
+ *
+ * `KABMO_DATA_DIR` and `PORT` are process-wide, so both are snapshotted
+ * and restored; sibling suites share the `bun test` process.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { action as restartRoute } from '@/server/routes/console/restart';
+import { writeInstanceRecord } from '@/server/lib/lifecycle/instance';
+
+const ORIGINAL_ENV = {
+  MOCK: Bun.env.MOCK,
+  KABMO_DATA_DIR: Bun.env.KABMO_DATA_DIR,
+  PORT: Bun.env.PORT,
+};
+const fixtures: string[] = [];
+
+async function payload(res: Response): Promise<Record<string, unknown>> {
+  return (await res.json()) as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'omc-chamber-restart-'));
+  fixtures.push(dir);
+  Bun.env.KABMO_DATA_DIR = dir;
+  delete Bun.env.MOCK;
+  delete Bun.env.PORT;
+});
+
+afterEach(() => {
+  for (const [key, value] of Object.entries(ORIGINAL_ENV)) {
+    if (value === undefined) delete Bun.env[key];
+    else Bun.env[key] = value;
+  }
+  for (const dir of fixtures.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+describe('POST /api/console/restart', () => {
+  test('a wrong verb is a 405', async () => {
+    const res = (await restartRoute({
+      request: new Request('http://localhost/api/console/restart', { method: 'GET' }),
+      params: {},
+    } as never)) as Response;
+    expect(res.status).toBe(405);
+    expect((await payload(res)).error).toBe('Method not allowed');
+  });
+
+  test('refuses to take a server down in MOCK mode', async () => {
+    Bun.env.MOCK = '1';
+    const res = (await restartRoute({ request: new Request("http://localhost/api/console/restart", { method: "POST" }), params: {} } as never)) as Response;
+    expect(res.status).toBe(200);
+    const body = await payload(res);
+    expect(body.restarting).toBe(false);
+    expect(body.isMock).toBe(true);
+    expect(body.message).toContain('mock mode');
+  });
+
+  test('a source-run instance is refused with the restart wording, not the update one', async () => {
+    // `bun run dev` records `direct`: replacing it would end the user's loop, so
+    // the route answers a refusal and never arms the detached restart.
+    writeInstanceRecord({
+      pid: process.pid,
+      port: 4301,
+      host: 'localhost',
+      mode: 'dev',
+      launchMode: 'direct',
+      tray: false,
+      tls: false,
+      auth: false,
+      startedAt: '2026-10-01T10:00:00.000Z',
+      version: '0.5.0',
+    });
+    const res = (await restartRoute({ request: new Request("http://localhost/api/console/restart", { method: "POST" }), params: {} } as never)) as Response;
+    expect(res.status).toBe(200);
+    const body = await payload(res);
+    expect(body.success).toBe(true);
+    expect(body.restarting).toBe(false);
+    expect(String(body.message)).toContain('runs from source');
+    expect(String(body.message)).not.toContain('apply the update');
+  });
+});

package/src/server/routes/console/restart.ts

@@ -0,0 +1,44 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * POST /api/console/restart — stop this instance and serve it again.
+ *
+ * The settings sidebar's "Restart Kabmo" button. It is the same operation
+ * `kabmo restart --port <port>` performs, armed as a detached child once
+ * the response has left (`RESTART_GRACE_MS`), because a process cannot replace
+ * itself while it still holds the port. The console then waits for a process
+ * with a different identity to answer `/api/health` and reloads into it — the
+ * same contract `POST /api/updates/apply` uses, so a restart reached from
+ * either surface behaves identically.
+ *
+ * An instance the CLI did not start is REFUSED, with the reason in `message`:
+ * `bun run dev` is a supervisor Kabmo does not own, and signalling it
+ * would end the user's dev loop rather than restart it.
+ */
+
+import { json } from '@/server/lib/remix-compat';
+import type { ActionFunctionArgs } from '@/server/lib/remix-compat';
+import { methodNotAllowed } from '@/server/lib/route-adapter';
+import { isMockMode } from '@/server/mock.server';
+import { scheduleSelfRestart } from '@/server/lib/lifecycle/restart';
+
+export async function action({ request, params }: ActionFunctionArgs) {
+  if (request.method !== 'POST') return methodNotAllowed({ request, params });
+  // A restart ends a process. In demo mode Kabmo is showing presets over
+  // whatever the developer is running, and pressing a button in a demo must
+  // not take a server down, so the refusal is stated rather than simulated.
+  if (isMockMode()) {
+    return json({
+      success: true,
+      restarting: false,
+      isMock: true,
+      message: 'Restart is unavailable in mock mode.',
+    });
+  }
+
+  const plan = scheduleSelfRestart('restart');
+  return json({ success: true, restarting: plan.restarting, message: plan.message });
+}

package/src/server/routes/dictation/ws.ts

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Dictation WebSocket: one utterance in, one transcript out, with model
+ * download progress pushed while the first decode waits on a fetch.
+ *
+ * The transcription itself is omp's own local STT — this route only owns the
+ * browser half (audio bytes and progress). See `omp-stt-worker.ts` for why the
+ * work happens in a spawned worker rather than the agent RPC.
+ *
+ * Per-connection state lives on `ws.data`, not in a `WeakMap` keyed by the
+ * `ws` object — Elysia hands a different wrapper to `message`/`close` than the
+ * one `open` received (the same trap `terminal/ws.ts` documents).
+ */
+
+import { Elysia } from 'elysia';
+import { isSameOriginUpgrade } from '@/server/lib/http/same-origin';
+import { sttWorker } from '@/server/lib/dictation/omp-stt-worker';
+import { resolveDictationLanguage } from '@/server/lib/dictation/language.server';
+import { pcm16ToFloat32 } from '@/shared/lib/dictation/audio';
+import { summarizeProgress, type SttProgressSummary } from '@/shared/lib/dictation/models';
+import {
+  DICTATION_MAX_AUDIO_BYTES,
+  encodeDictationFrame,
+  decodeDictationClientFrame,
+  type DictationServerFrame,
+} from '@/shared/lib/dictation/protocol';
+
+interface DictationState {
+  /** Percent last reported, so a burst of file events does not flood the socket. */
+  lastPercent: number | null;
+  lastDecoding: boolean;
+}
+
+type DictationWsData = { dictation?: DictationState };
+
+/** Only progress that moves by a point or flips phase is worth a frame. */
+function shouldEmitProgress(state: DictationState, summary: SttProgressSummary): boolean {
+  if (summary.decoding !== state.lastDecoding) return true;
+  // No overall figure (a per-file event): the last percent stays on screen, so
+  // re-sending it would be pure noise — the download can emit hundreds of these.
+  if (summary.percent === null) return false;
+  if (state.lastPercent === null) return true;
+  return Math.abs(summary.percent - state.lastPercent) >= 1;
+}
+
+export const dictationWsRoutes = new Elysia({ prefix: '/api/dictation' }).ws('/ws', {
+  beforeHandle({ request, status }) {
+    if (!isSameOriginUpgrade(request)) return status(403, 'Cross-origin dictation upgrade rejected');
+  },
+
+  open(ws) {
+    (ws.data as unknown as DictationWsData).dictation = { lastPercent: null, lastDecoding: false };
+    ws.send(encodeDictationFrame({ type: 'ready' }));
+  },
+
+  async message(ws, raw) {
+    const state = (ws.data as unknown as DictationWsData).dictation;
+    if (!state) return;
+
+    const send = (frame: DictationServerFrame) => {
+      try {
+        ws.send(encodeDictationFrame(frame));
+      } catch {
+        // Socket closed mid-transcribe; the result is dropped with it.
+      }
+    };
+
+    // Elysia hands this an already-parsed object (see the decoder's docs).
+    const frame = decodeDictationClientFrame(raw);
+    if (!frame) return;
+
+    // base64 is 4/3 of the byte count; guard before decoding, not after.
+    if (frame.audio.length > (DICTATION_MAX_AUDIO_BYTES * 4) / 3) {
+      send({ type: 'error', error: 'The recording is too long.', retryable: true });
+      return;
+    }
+
+    // The wire carries compact PCM16; omp's worker takes normalized Float32 and
+    // rejects every other shape (see `shared/lib/dictation/audio.ts`).
+    const samples = pcm16ToFloat32(new Uint8Array(Buffer.from(frame.audio, 'base64')));
+
+    try {
+      // A language the CLIENT sent wins (nothing sends one today, but the frame
+      // carries the field); otherwise the session's configured `stt.language`
+      // decides. An absent value means auto-detect, which is what the worker
+      // does with no `language`.
+      const text = await sttWorker().transcribe(samples, {
+        modelKey: frame.modelKey,
+        language: frame.language ?? (await resolveDictationLanguage()),
+        onProgress: (event) => {
+          const summary = summarizeProgress(event);
+          if (!shouldEmitProgress(state, summary)) return;
+          state.lastPercent = summary.percent;
+          state.lastDecoding = summary.decoding;
+          send({ type: 'progress', ...summary });
+        },
+      });
+
+      if (text.trim().length === 0) {
+        send({ type: 'error', error: 'No speech detected.', retryable: true });
+        return;
+      }
+      send({ type: 'final', text: text.trim() });
+    } catch (error) {
+      send({
+        type: 'error',
+        error: error instanceof Error ? error.message : 'Speech transcription failed.',
+        retryable: true,
+      });
+    }
+  },
+});

package/src/server/routes/files/index.ts

@@ -0,0 +1,10 @@
+import { bindingsFor, type HandlerBinding } from '@/server/lib/route-adapter';
+import * as filesRoot from '@/server/routes/files/root';
+import * as filesToggle from '@/server/routes/files/toggle';
+
+export const filesBindings: HandlerBinding[] = [
+  // Both routes share the first path segment, so Elysia requires one parameter
+  // name there; `fileId` is the name the toggle handler reads.
+  ...bindingsFor(filesRoot, '/api/files/:fileId'),
+  ...bindingsFor(filesToggle, '/api/files/:fileId/toggle'),
+];

package/src/server/routes/files/root.ts

@@ -0,0 +1,29 @@
+import { json } from '@/server/lib/remix-compat';
+import type { LoaderFunctionArgs } from '@/server/lib/remix-compat';
+import { getDb } from '@/server/db.server';
+
+export async function loader({ params }: LoaderFunctionArgs) {
+  const db = await getDb();
+  const sessionId = params.fileId;
+  
+  const files = await db.all('SELECT * FROM files WHERE session_id = ? ORDER BY type DESC, name ASC', [sessionId]);
+  
+  // Convert flat list to tree
+  const fileMap = new Map();
+  files.forEach(f => fileMap.set(f.id, { ...f, children: [] }));
+  
+  const rootFiles: any[] = [];
+  
+  files.forEach(f => {
+    if (f.parent_id === null) {
+      rootFiles.push(fileMap.get(f.id));
+    } else {
+      const parent = fileMap.get(f.parent_id);
+      if (parent) {
+        parent.children.push(fileMap.get(f.id));
+      }
+    }
+  });
+
+  return json({ files: rootFiles });
+}

package/src/server/routes/files/toggle.ts

@@ -0,0 +1,20 @@
+import { json } from '@/server/lib/remix-compat';
+import type { ActionFunctionArgs } from '@/server/lib/remix-compat';
+import { methodNotAllowed } from '@/server/lib/route-adapter';
+import { getDb } from '@/server/db.server';
+
+export async function action({ request, params }: ActionFunctionArgs) {
+  if (request.method !== 'POST') {
+    return methodNotAllowed({ request, params });
+  }
+
+  const db = await getDb();
+  const fileId = params.fileId;
+  const formData = await request.formData();
+  
+  const isExpanded = formData.get('isExpanded') === 'true' ? 1 : 0;
+  
+  await db.run('UPDATE files SET is_expanded = ? WHERE id = ?', [isExpanded, fileId]);
+  
+  return json({ success: true, isExpanded });
+}