@pixelbyte-software/pixcode 1.30.1 → 1.31.0

package/dist-server/server/index.js

@@ -10,6 +10,15 @@ const __dirname = getModuleDir(import.meta.url);
 // Resolving the app root once keeps every repo-level lookup below aligned across both layouts.
 const APP_ROOT = findAppRoot(__dirname);
 const installMode = fs.existsSync(path.join(APP_ROOT, '.git')) ? 'git' : 'npm';
+const SERVER_VERSION = (() => {
+    try {
+        const pkgRaw = fs.readFileSync(path.join(APP_ROOT, 'package.json'), 'utf8');
+        return JSON.parse(pkgRaw).version || '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
 const DAEMON_COMMAND_CONTEXT = {
     appRoot: APP_ROOT,
     cliEntry: path.join(APP_ROOT, 'server', 'cli.js'),
@@ -32,6 +41,7 @@ import { queryClaudeSDK, abortClaudeSDKSession, isClaudeSDKSessionActive, getAct
 import { spawnCursor, abortCursorSession, isCursorSessionActive, getActiveCursorSessions } from './cursor-cli.js';
 import { queryCodex, abortCodexSession, isCodexSessionActive, getActiveCodexSessions } from './openai-codex.js';
 import { spawnGemini, abortGeminiSession, isGeminiSessionActive, getActiveGeminiSessions } from './gemini-cli.js';
+import { spawnQwen, abortQwenSession, isQwenSessionActive, getActiveQwenSessions } from './qwen-code-cli.js';
 import sessionManager from './sessionManager.js';
 import gitRoutes from './routes/git.js';
 import authRoutes from './routes/auth.js';
@@ -42,13 +52,19 @@ import commandsRoutes from './routes/commands.js';
 import settingsRoutes from './routes/settings.js';
 import agentRoutes from './routes/agent.js';
 import projectsRoutes, { WORKSPACES_ROOT, WORKSPACES_BASE, validateWorkspacePath, normalizeWorkspacePath, } from './routes/projects.js';
-import cliAuthRoutes from './routes/cli-auth.js';
 import userRoutes from './routes/user.js';
 import codexRoutes from './routes/codex.js';
 import geminiRoutes from './routes/gemini.js';
+import qwenRoutes from './routes/qwen.js';
 import pluginsRoutes from './routes/plugins.js';
 import messagesRoutes from './routes/messages.js';
 import providerRoutes from './modules/providers/provider.routes.js';
+import networkRoutes from './routes/network.js';
+import telegramRoutes from './routes/telegram.js';
+import { restoreBotFromConfig } from './services/telegram/bot.js';
+import { ensurePortOpen } from './utils/port-access.js';
+import { applyAllStoredCredentialsToEnv, applyProviderCredentialsToEnv, listProviderCredentialSummaries, PROVIDER_ENV_VARS, setProviderCredentials, } from './services/provider-credentials.js';
+import { primeCliBinPath } from './services/install-jobs.js';
 import { startEnabledPluginServers, stopAllPlugins, getPluginPort } from './utils/plugin-process-manager.js';
 import { initializeDatabase, sessionNamesDb, applyCustomSessionNames } from './database/db.js';
 import { configureWebPush } from './services/vapid-keys.js';
@@ -56,7 +72,7 @@ import { validateApiKey, authenticateToken, authenticateWebSocket } from './midd
 import { IS_PLATFORM } from './constants/config.js';
 import { getConnectableHost } from '../shared/networkHosts.js';
 import { buildDaemonCliCommand, handleDaemonCommand } from './daemon-manager.js';
-const VALID_PROVIDERS = ['claude', 'codex', 'cursor', 'gemini'];
+const VALID_PROVIDERS = ['claude', 'codex', 'cursor', 'gemini', 'qwen'];
 // File system watchers for provider project/session folders
 const PROVIDER_WATCH_PATHS = [
     { provider: 'claude', rootPath: path.join(os.homedir(), '.claude', 'projects') },
@@ -65,6 +81,10 @@ const PROVIDER_WATCH_PATHS = [
     { provider: 'gemini', rootPath: path.join(os.homedir(), '.gemini', 'projects') },
     { provider: 'gemini_sessions', rootPath: path.join(os.homedir(), '.gemini', 'sessions') },
     { provider: 'gemini_cli', rootPath: path.join(os.homedir(), '.gemini', 'tmp') },
+    // Qwen Code is a Gemini-CLI fork so its on-disk layout mirrors ~/.gemini/.
+    { provider: 'qwen', rootPath: path.join(os.homedir(), '.qwen', 'projects') },
+    { provider: 'qwen_sessions', rootPath: path.join(os.homedir(), '.qwen', 'sessions') },
+    { provider: 'qwen_cli', rootPath: path.join(os.homedir(), '.qwen', 'tmp') },
 ];
 const WATCHER_IGNORED_PATTERNS = [
     '**/node_modules/**',
@@ -244,7 +264,8 @@ app.get('/health', (req, res) => {
     res.json({
         status: 'ok',
         timestamp: new Date().toISOString(),
-        installMode
+        installMode,
+        version: SERVER_VERSION
     });
 });
 // Optional API key validation (if configured)
@@ -271,12 +292,18 @@ app.use('/api/user', authenticateToken, userRoutes);
 app.use('/api/codex', authenticateToken, codexRoutes);
 // Gemini API Routes (protected)
 app.use('/api/gemini', authenticateToken, geminiRoutes);
+// Qwen Code API Routes (protected)
+app.use('/api/qwen', authenticateToken, qwenRoutes);
 // Plugins API Routes (protected)
 app.use('/api/plugins', authenticateToken, pluginsRoutes);
 // Unified session messages route (protected)
 app.use('/api/sessions', authenticateToken, messagesRoutes);
 // Unified provider MCP routes (protected)
 app.use('/api/providers', authenticateToken, providerRoutes);
+// Network discovery / QR endpoints (protected)
+app.use('/api/network', authenticateToken, networkRoutes);
+// Telegram integration (protected)
+app.use('/api/telegram', authenticateToken, telegramRoutes);
 // Agent API Routes (uses API key authentication)
 app.use('/api/agent', agentRoutes);
 // Serve public files (like api-docs.html)
@@ -300,70 +327,122 @@ app.use(express.static(path.join(APP_ROOT, 'dist'), {
 // API Routes (protected)
 // /api/config endpoint removed - no longer needed
 // Frontend now uses window.location for WebSocket URLs
-// System update endpoint
+// System update endpoint — streams live output via Server-Sent Events so the
+// UI sees npm/git progress in real time instead of waiting ~2 minutes for the
+// buffered response.
 app.post('/api/system/update', authenticateToken, async (req, res) => {
-    try {
-        // Get the project root directory (parent of server directory)
-        const projectRoot = APP_ROOT;
-        console.log('Starting system update from directory:', projectRoot);
-        // Platform deployments use their own update workflow from the project root.
-        const updateCommand = IS_PLATFORM
-            // In platform, husky and dev dependencies are not needed
-            ? 'npm run update:platform'
-            : installMode === 'git'
-                ? 'git checkout main && git pull && npm install'
-                : 'npm install -g @pixelbyte-software/pixcode@latest';
-        const updateCwd = IS_PLATFORM || installMode === 'git'
-            ? projectRoot
-            : os.homedir();
-        const child = spawn('sh', ['-c', updateCommand], {
-            cwd: updateCwd,
-            env: process.env
-        });
-        let output = '';
-        let errorOutput = '';
-        child.stdout.on('data', (data) => {
-            const text = data.toString();
-            output += text;
-            console.log('Update output:', text);
-        });
-        child.stderr.on('data', (data) => {
-            const text = data.toString();
-            errorOutput += text;
-            console.error('Update error:', text);
-        });
-        child.on('close', (code) => {
-            if (code === 0) {
-                res.json({
-                    success: true,
-                    output: output || 'Update completed successfully',
-                    message: 'Update completed. Please restart the server to apply changes.'
-                });
-            }
-            else {
-                res.status(500).json({
-                    success: false,
-                    error: 'Update command failed',
-                    output: output,
-                    errorOutput: errorOutput
-                });
+    const projectRoot = APP_ROOT;
+    console.log('Starting system update from directory:', projectRoot);
+    const updateCommand = IS_PLATFORM
+        ? 'npm run update:platform'
+        : installMode === 'git'
+            ? 'git checkout main && git pull && npm install'
+            : 'npm install -g @pixelbyte-software/pixcode@latest';
+    const updateCwd = IS_PLATFORM || installMode === 'git'
+        ? projectRoot
+        : os.homedir();
+    res.setHeader('Content-Type', 'text/event-stream');
+    res.setHeader('Cache-Control', 'no-cache, no-transform');
+    res.setHeader('Connection', 'keep-alive');
+    res.setHeader('X-Accel-Buffering', 'no');
+    if (typeof res.flushHeaders === 'function') {
+        res.flushHeaders();
+    }
+    // Single-source end guard. When spawn() fails with ENOENT both the
+    // 'error' and 'close' handlers can fire on the child, and before this
+    // guard both would try to write a `done` event + call res.end(), which
+    // crashed the process with ERR_HTTP_HEADERS_SENT.
+    let ended = false;
+    const endStream = () => {
+        if (ended)
+            return;
+        ended = true;
+        clearInterval(heartbeat);
+        res.end();
+    };
+    const send = (event, payload) => {
+        if (ended)
+            return;
+        res.write(`event: ${event}\n`);
+        res.write(`data: ${JSON.stringify(payload)}\n\n`);
+    };
+    // Heartbeat keeps intermediate proxies from closing an idle connection
+    // during long npm installs. Declared before spawn so the handlers below
+    // can reference it, and guarded against writes after end.
+    const heartbeat = setInterval(() => {
+        if (ended)
+            return;
+        res.write(': ping\n\n');
+    }, 15000);
+    send('log', { stream: 'meta', chunk: `Running: ${updateCommand}\n` });
+    // Cross-platform shell invocation. Using { shell: true } delegates to
+    // cmd.exe on Windows and /bin/sh on POSIX, so the endpoint no longer
+    // fails with `spawn sh ENOENT` on Windows installs.
+    const child = spawn(updateCommand, {
+        cwd: updateCwd,
+        env: process.env,
+        shell: true,
+    });
+    let clientAborted = false;
+    req.on('close', () => {
+        if (!res.writableEnded) {
+            clientAborted = true;
+            try {
+                child.kill();
             }
-        });
-        child.on('error', (error) => {
-            console.error('Update process error:', error);
-            res.status(500).json({
+            catch { /* noop */ }
+        }
+    });
+    child.stdout?.on('data', (data) => {
+        send('log', { stream: 'stdout', chunk: data.toString() });
+    });
+    child.stderr?.on('data', (data) => {
+        send('log', { stream: 'stderr', chunk: data.toString() });
+    });
+    child.on('error', (error) => {
+        if (ended)
+            return;
+        console.error('Update process error:', error);
+        send('done', { success: false, error: error.message });
+        endStream();
+    });
+    child.on('close', (code) => {
+        if (ended)
+            return;
+        if (clientAborted) {
+            endStream();
+            return;
+        }
+        if (code === 0) {
+            send('done', {
+                success: true,
+                version: SERVER_VERSION,
+                message: 'Update completed. Restart the server to apply changes.',
+            });
+        }
+        else {
+            send('done', {
                 success: false,
-                error: error.message
+                error: `Update command exited with code ${code}`,
             });
-        });
-    }
-    catch (error) {
-        console.error('System update error:', error);
-        res.status(500).json({
-            success: false,
-            error: error.message
-        });
-    }
+        }
+        endStream();
+    });
+});
+// Restart endpoint — exits the current process so an external wrapper
+// (systemd/pm2/daemon manager) can bring the server back on the new code.
+// Foreground installs without a wrapper will simply stop; the UI reports this.
+app.post('/api/system/restart', authenticateToken, (req, res) => {
+    res.json({
+        success: true,
+        version: SERVER_VERSION,
+        message: 'Server is shutting down for restart. Reconnecting...'
+    });
+    // Give the response time to flush before we exit.
+    setTimeout(() => {
+        console.log('Restart requested via /api/system/restart — exiting process.');
+        process.exit(0);
+    }, 250);
 });
 app.get('/api/projects', authenticateToken, async (req, res) => {
     try {
@@ -1318,6 +1397,13 @@ function handleChatConnection(ws, request) {
                 console.log('🤖 Model:', data.options?.model || 'default');
                 await spawnGemini(data.command, data.options, writer);
             }
+            else if (data.type === 'qwen-command') {
+                console.log('[DEBUG] Qwen Code message:', data.command || '[Continue/Resume]');
+                console.log('📁 Project:', data.options?.projectPath || data.options?.cwd || 'Unknown');
+                console.log('🔄 Session:', data.options?.sessionId ? 'Resume' : 'New');
+                console.log('🤖 Model:', data.options?.model || 'default');
+                await spawnQwen(data.command, data.options, writer);
+            }
             else if (data.type === 'cursor-resume') {
                 // Backward compatibility: treat as cursor-command with resume and no prompt
                 console.log('[DEBUG] Cursor resume session (compat):', data.sessionId);
@@ -1340,6 +1426,9 @@ function handleChatConnection(ws, request) {
                 else if (provider === 'gemini') {
                     success = abortGeminiSession(data.sessionId);
                 }
+                else if (provider === 'qwen') {
+                    success = abortQwenSession(data.sessionId);
+                }
                 else {
                     // Use Claude Agents SDK
                     success = await abortClaudeSDKSession(data.sessionId);
@@ -1378,6 +1467,9 @@ function handleChatConnection(ws, request) {
                 else if (provider === 'gemini') {
                     isActive = isGeminiSessionActive(sessionId);
                 }
+                else if (provider === 'qwen') {
+                    isActive = isQwenSessionActive(sessionId);
+                }
                 else {
                     // Use Claude Agents SDK
                     isActive = isClaudeSDKSessionActive(sessionId);
@@ -1412,7 +1504,8 @@ function handleChatConnection(ws, request) {
                     claude: getActiveClaudeSDKSessions(),
                     cursor: getActiveCursorSessions(),
                     codex: getActiveCodexSessions(),
-                    gemini: getActiveGeminiSessions()
+                    gemini: getActiveGeminiSessions(),
+                    qwen: getActiveQwenSessions()
                 };
                 writer.send({
                     type: 'active-sessions',
@@ -1508,7 +1601,11 @@ function handleShellConnection(ws) {
                     welcomeMsg = `\x1b[36mStarting terminal in: ${projectPath}\x1b[0m\r\n`;
                 }
                 else {
-                    const providerName = provider === 'cursor' ? 'Cursor' : (provider === 'codex' ? 'Codex' : (provider === 'gemini' ? 'Gemini' : 'Claude'));
+                    const providerName = provider === 'cursor' ? 'Cursor'
+                        : provider === 'codex' ? 'Codex'
+                            : provider === 'gemini' ? 'Gemini'
+                                : provider === 'qwen' ? 'Qwen Code'
+                                    : 'Claude';
                     welcomeMsg = hasSession ?
                         `\x1b[36mResuming ${providerName} session ${sessionId} in: ${projectPath}\x1b[0m\r\n` :
                         `\x1b[36mStarting new ${providerName} session in: ${projectPath}\x1b[0m\r\n`;
@@ -1593,6 +1690,33 @@ function handleShellConnection(ws) {
                             shellCommand = command;
                         }
                     }
+                    else if (provider === 'qwen') {
+                        // Qwen Code shares Gemini CLI's --resume semantics (it's a fork),
+                        // so the resume path resolves the backend-tracked cliSessionId the
+                        // same way. Falls back to a fresh session when the ID can't be found.
+                        const command = initialCommand || 'qwen';
+                        let resumeId = sessionId;
+                        if (hasSession && sessionId) {
+                            try {
+                                const sess = sessionManager.getSession(sessionId);
+                                if (sess && sess.cliSessionId) {
+                                    resumeId = sess.cliSessionId;
+                                    if (!safeSessionIdPattern.test(resumeId)) {
+                                        resumeId = null;
+                                    }
+                                }
+                            }
+                            catch (err) {
+                                console.error('Failed to get Qwen Code CLI session ID:', err);
+                            }
+                        }
+                        if (hasSession && resumeId) {
+                            shellCommand = `${command} --resume "${resumeId}"`;
+                        }
+                        else {
+                            shellCommand = command;
+                        }
+                    }
                     else {
                         // Claude (default provider)
                         const command = initialCommand || 'claude';
@@ -1870,6 +1994,17 @@ app.get('/api/projects/:projectName/sessions/:sessionId/token-usage', authentica
                 message: 'Token usage tracking not available for Gemini sessions'
             });
         }
+        // Qwen Code is a Gemini CLI fork and doesn't expose per-session token
+        // accounting either; treat it the same way.
+        if (provider === 'qwen') {
+            return res.json({
+                used: 0,
+                total: 0,
+                breakdown: { input: 0, cacheCreation: 0, cacheRead: 0 },
+                unsupported: true,
+                message: 'Token usage tracking not available for Qwen Code sessions'
+            });
+        }
         // Handle Codex sessions
         if (provider === 'codex') {
             const codexSessionsDir = path.join(homeDir, '.codex', 'sessions');
@@ -2280,6 +2415,31 @@ async function startServer() {
         await initializeDatabase();
         // Configure Web Push (VAPID keys)
         configureWebPush();
+        // Load any provider API keys saved through the UI into process.env so
+        // the Claude/Codex SDKs pick them up automatically. Spawn-based
+        // adapters (Gemini, Qwen) layer their own env on top via buildSpawnEnv.
+        try {
+            await applyAllStoredCredentialsToEnv();
+        }
+        catch (err) {
+            console.warn('[provider-credentials] Failed to apply stored credentials:', err?.message || err);
+        }
+        // Prepend the pixcode-managed CLI sandbox
+        // (~/.pixcode/cli-bin/node_modules/.bin) to PATH so any provider CLI
+        // installed via the in-app installer is instantly resolvable by
+        // cross-spawn calls in the provider adapters — no server restart
+        // required, no need to touch the user's shell PATH.
+        try {
+            primeCliBinPath();
+        }
+        catch (err) {
+            console.warn('[install-jobs] Failed to prime CLI bin path:', err?.message || err);
+        }
+        // Restore any previously-configured Telegram bot. This is best-effort:
+        // a bad token or network blip should warn, not crash the server.
+        restoreBotFromConfig().catch((err) => {
+            console.warn('[telegram] restore failed:', err?.message || err);
+        });
         // Check if running in production mode (dist folder exists)
         const distIndexPath = path.join(APP_ROOT, 'dist', 'index.html');
         const isProduction = fs.existsSync(distIndexPath);
@@ -2299,6 +2459,15 @@ async function startServer() {
             console.log('');
             console.log(`${c.info('[INFO]')} Server URL:  ${c.bright('http://' + DISPLAY_HOST + ':' + SERVER_PORT)}`);
             console.log(`${c.info('[INFO]')} Installed at: ${c.dim(appInstallPath)}`);
+            // Print LAN IP + open inbound firewall port (Linux auto, Windows/Mac
+            // ask interactively once, then persist the decision). Non-fatal on
+            // any error — LAN access often works without a rule anyway.
+            try {
+                await ensurePortOpen(Number(SERVER_PORT));
+            }
+            catch (err) {
+                console.log(`${c.dim('[INFO]')} Port-access helper failed: ${err?.message || err}`);
+            }
             console.log(`${c.tip('[TIP]')}  Run "pixcode status" for full configuration details`);
             console.log('');
             // Start watching the projects folder for changes