@pixelbyte-software/pixcode 1.51.2 → 1.51.4

package/dist-server/server/index.js

@@ -84,7 +84,7 @@ import productionAgentLoopRoutes from './routes/production-agent-loop.js';
 import platformizationRoutes from './routes/platformization.js';
 import liveViewRoutes, { createLiveViewPublicRouter } from './routes/live-view.js';
 import providerRoutes from './modules/providers/provider.routes.js';
-import { createHermesTaskRouter, adapterRegistry, ClaudeCodeA2AAdapter, CodexA2AAdapter, CursorA2AAdapter, GeminiA2AAdapter, OpenCodeA2AAdapter, QwenA2AAdapter, createPreviewProxyRouter, createOrchestrationTaskRouter, createHermesRouter, createWorkflowRouter, } from './modules/orchestration/index.js';
+import { createHermesTaskRouter, adapterRegistry, ClaudeCodeA2AAdapter, CodexA2AAdapter, CursorA2AAdapter, GeminiA2AAdapter, OpenCodeA2AAdapter, QwenA2AAdapter, JsonEventA2AAdapter, createPreviewProxyRouter, createOrchestrationTaskRouter, createHermesRouter, createWorkflowRouter, } from './modules/orchestration/index.js';
 import networkRoutes from './routes/network.js';
 import telegramRoutes from './routes/telegram.js';
 import { restoreRequestedTunnel } from './services/external-access.js';
@@ -97,11 +97,38 @@ import { startEnabledPluginServers, stopAllPlugins, getPluginPort } from './util
 import { initializeDatabase, sessionNamesDb, applyCustomSessionNames, apiKeysDb } from './database/db.js';
 import { setNotificationWebSocketServer } from './services/notification-orchestrator.js';
 import { configureWebPush } from './services/vapid-keys.js';
-import { validateApiKey, authenticateToken, authenticateWebSocket } from './middleware/auth.js';
+import { validateApiKey, authenticateToken, authenticateWebSocket, requireAdmin } from './middleware/auth.js';
+import { filterProjectsForUser, userHasProjectAccess } from './services/platformization.js';
 import { IS_PLATFORM } from './constants/config.js';
 import { getConnectableHost } from '../shared/networkHosts.js';
 import { buildDaemonCliCommand, handleDaemonCommand } from './daemon-manager.js';
 const VALID_PROVIDERS = ['claude', 'codex', 'cursor', 'gemini', 'qwen', 'opencode'];
+function requireProjectAccess(capability = 'viewFiles') {
+    return (req, res, next) => {
+        const projectName = req.params.projectName || req.query.project || req.body?.project;
+        if (!projectName) {
+            return next();
+        }
+        if (!userHasProjectAccess(req.user, { name: String(projectName), projectName: String(projectName) }, capability)) {
+            return res.status(403).json({ error: 'Project access denied.' });
+        }
+        next();
+    };
+}
+function requireProjectPathAccess(capability = 'viewFiles') {
+    return (req, res, next) => {
+        const projectPath = req.body?.projectPath || req.query.projectPath || os.homedir();
+        const resolvedProjectPath = path.resolve(String(projectPath));
+        if (!userHasProjectAccess(req.user, {
+            fullPath: resolvedProjectPath,
+            path: resolvedProjectPath,
+            projectPath: resolvedProjectPath,
+        }, capability)) {
+            return res.status(403).json({ error: 'Project access denied.' });
+        }
+        next();
+    };
+}
 // File system watchers for provider project/session folders
 const PROVIDER_WATCH_PATHS = [
     { provider: 'claude', rootPath: path.join(os.homedir(), '.claude', 'projects') },
@@ -181,18 +208,20 @@ async function setupProjectsWatcher() {
                 clearProjectDirectoryCache();
                 // Get updated projects list
                 const updatedProjects = await getProjects(broadcastProgress);
-                // Notify all connected clients about the project changes
-                const updateMessage = JSON.stringify({
+                const updatePayload = {
                     type: 'projects_updated',
-                    projects: updatedProjects,
                     timestamp: new Date().toISOString(),
                     changeType: eventType,
                     changedFile: path.relative(rootPath, filePath),
                     watchProvider: provider
-                });
+                };
+                // Notify all connected clients about project changes, scoped to their access.
                 connectedClients.forEach(client => {
                     if (client.readyState === WebSocket.OPEN) {
-                        client.send(updateMessage);
+                        client.send(JSON.stringify({
+                            ...updatePayload,
+                            projects: filterProjectsForUser(updatedProjects, client.user),
+                        }));
                     }
                 });
             }
@@ -249,6 +278,111 @@ async function setupProjectsWatcher() {
         console.error('[ERROR] Failed to setup any provider watchers');
     }
 }
+// ── Per-project workspace watchers (file explorer live refresh) ─────────────
+// setupProjectsWatcher() above only watches provider metadata folders
+// (~/.claude/projects etc.), so the file explorer never learned about changes
+// inside the actual project working directory. These watchers are created on
+// demand when a client sends `watch-project` over /ws and broadcast debounced
+// `project_files_updated` events to subscribed clients only, letting the
+// explorer refresh automatically without HTTP polling.
+const WORKSPACE_WATCHER_DEBOUNCE_MS = 800;
+const workspaceWatchers = new Map(); // projectName -> { watcher, subscribers, debounceTimer, pendingEvent, rootPath }
+async function subscribeToWorkspace(ws, projectName) {
+    if (!projectName || typeof projectName !== 'string')
+        return;
+    if (!userHasProjectAccess(ws.user, { name: projectName, projectName }, 'viewFiles'))
+        return;
+    const existing = workspaceWatchers.get(projectName);
+    if (existing) {
+        existing.subscribers.add(ws);
+        return;
+    }
+    let rootPath;
+    try {
+        rootPath = await extractProjectDirectory(projectName);
+        await fsPromises.access(rootPath);
+    }
+    catch (error) {
+        console.warn(`[watcher] Cannot watch workspace for ${projectName}:`, error.message);
+        return;
+    }
+    const entry = {
+        watcher: null,
+        subscribers: new Set([ws]),
+        debounceTimer: null,
+        pendingEvent: null,
+        rootPath,
+    };
+    workspaceWatchers.set(projectName, entry);
+    const broadcastFileUpdate = (eventType, filePath) => {
+        entry.pendingEvent = { eventType, filePath };
+        if (entry.debounceTimer) {
+            clearTimeout(entry.debounceTimer);
+        }
+        entry.debounceTimer = setTimeout(() => {
+            entry.debounceTimer = null;
+            const pending = entry.pendingEvent || {};
+            entry.pendingEvent = null;
+            const message = JSON.stringify({
+                type: 'project_files_updated',
+                projectName,
+                changeType: pending.eventType || 'change',
+                changedFile: pending.filePath ? path.relative(rootPath, pending.filePath) : null,
+                timestamp: new Date().toISOString(),
+            });
+            entry.subscribers.forEach((client) => {
+                if (client.readyState === WebSocket.OPEN) {
+                    client.send(message);
+                }
+            });
+        }, WORKSPACE_WATCHER_DEBOUNCE_MS);
+    };
+    try {
+        const chokidar = (await import('chokidar')).default;
+        const watcher = chokidar.watch(rootPath, {
+            ignored: WATCHER_IGNORED_PATTERNS,
+            persistent: true,
+            ignoreInitial: true,
+            followSymlinks: false,
+            depth: 10,
+            awaitWriteFinish: {
+                stabilityThreshold: 500,
+                pollInterval: 250
+            }
+        });
+        watcher
+            .on('add', (filePath) => broadcastFileUpdate('add', filePath))
+            .on('change', (filePath) => broadcastFileUpdate('change', filePath))
+            .on('unlink', (filePath) => broadcastFileUpdate('unlink', filePath))
+            .on('addDir', (dirPath) => broadcastFileUpdate('addDir', dirPath))
+            .on('unlinkDir', (dirPath) => broadcastFileUpdate('unlinkDir', dirPath))
+            .on('error', (error) => {
+            console.error(`[ERROR] Workspace watcher error for ${projectName}:`, error);
+        });
+        entry.watcher = watcher;
+    }
+    catch (error) {
+        workspaceWatchers.delete(projectName);
+        console.error(`[ERROR] Failed to watch workspace for ${projectName}:`, error);
+    }
+}
+function unsubscribeFromWorkspace(ws, projectName = null) {
+    const entries = projectName
+        ? (workspaceWatchers.has(projectName) ? [[projectName, workspaceWatchers.get(projectName)]] : [])
+        : Array.from(workspaceWatchers.entries());
+    for (const [name, entry] of entries) {
+        entry.subscribers.delete(ws);
+        if (entry.subscribers.size === 0) {
+            if (entry.debounceTimer) {
+                clearTimeout(entry.debounceTimer);
+            }
+            workspaceWatchers.delete(name);
+            entry.watcher?.close().catch((error) => {
+                console.warn(`[watcher] Failed to close workspace watcher for ${name}:`, error?.message || error);
+            });
+        }
+    }
+}
 const app = express();
 const server = http.createServer(app);
 const ptySessionsMap = new Map();
@@ -661,7 +795,7 @@ app.get('/health', (req, res) => {
 });
 // Optional API key validation (if configured)
 app.use('/api', validateApiKey);
-app.post('/api/shell/sessions/terminate', authenticateToken, (req, res) => {
+app.post('/api/shell/sessions/terminate', authenticateToken, requireProjectPathAccess('useShell'), (req, res) => {
     const provider = req.body?.provider || 'claude';
     const projectPath = req.body?.projectPath || os.homedir();
     if (!SHELL_CLI_PROVIDERS.has(provider)) {
@@ -670,7 +804,7 @@ app.post('/api/shell/sessions/terminate', authenticateToken, (req, res) => {
     const killedSessions = killProviderPtySessions(projectPath, provider);
     res.json({ success: true, killedSessions });
 });
-app.get('/api/shell/sessions/provider-output', authenticateToken, (req, res) => {
+app.get('/api/shell/sessions/provider-output', authenticateToken, requireProjectPathAccess('useShell'), (req, res) => {
     const provider = String(req.query.provider || 'claude');
     const projectPath = typeof req.query.projectPath === 'string' && req.query.projectPath.trim()
         ? req.query.projectPath.trim()
@@ -717,7 +851,7 @@ app.get('/api/shell/sessions/provider-output', authenticateToken, (req, res) =>
         output,
     });
 });
-app.post('/api/shell/sessions/provider-input', authenticateToken, (req, res) => {
+app.post('/api/shell/sessions/provider-input', authenticateToken, requireProjectPathAccess('useShell'), (req, res) => {
     const provider = String(req.body?.provider || 'claude');
     const projectPath = typeof req.body?.projectPath === 'string' && req.body.projectPath.trim()
         ? req.body.projectPath.trim()
@@ -813,8 +947,8 @@ app.use('/api/public', authenticateToken, publicApiRoutes);
 app.use('/api/webhooks', authenticateToken, webhooksRoutes);
 // Production agent loop APIs (protected)
 app.use('/api/production-agent-loop', authenticateToken, productionAgentLoopRoutes);
-// Platform control plane APIs (protected)
-app.use('/api/platformization', authenticateToken, platformizationRoutes);
+// Platform control plane APIs (admin-only)
+app.use('/api/platformization', authenticateToken, requireAdmin, platformizationRoutes);
 // Project Live View (protected control API + public share proxy)
 app.use('/api/live-view', authenticateToken, liveViewRoutes);
 // Unified provider MCP routes (protected)
@@ -826,6 +960,7 @@ adapterRegistry.register(new CursorA2AAdapter());
 adapterRegistry.register(new GeminiA2AAdapter());
 adapterRegistry.register(new QwenA2AAdapter());
 adapterRegistry.register(new OpenCodeA2AAdapter());
+adapterRegistry.register(new JsonEventA2AAdapter());
 app.use('/hermes', createHermesTaskRouter());
 app.use('/preview', authenticateToken, createPreviewProxyRouter());
 app.use('/api/orchestration', authenticateToken, createOrchestrationTaskRouter());
@@ -1256,13 +1391,13 @@ app.post('/api/system/restart', authenticateToken, (req, res) => {
 app.get('/api/projects', authenticateToken, async (req, res) => {
     try {
         const projects = await getProjects(broadcastProgress);
-        res.json(projects);
+        res.json(filterProjectsForUser(projects, req.user));
     }
     catch (error) {
         res.status(500).json({ error: error.message });
     }
 });
-app.get('/api/projects/:projectName/sessions', authenticateToken, async (req, res) => {
+app.get('/api/projects/:projectName/sessions', authenticateToken, requireProjectAccess('viewFiles'), async (req, res) => {
     try {
         const { limit = 5, offset = 0 } = req.query;
         const result = await getSessions(req.params.projectName, parseInt(limit), parseInt(offset));
@@ -1274,7 +1409,7 @@ app.get('/api/projects/:projectName/sessions', authenticateToken, async (req, re
     }
 });
 // Rename project endpoint
-app.put('/api/projects/:projectName/rename', authenticateToken, async (req, res) => {
+app.put('/api/projects/:projectName/rename', authenticateToken, requireProjectAccess('manageProjectSettings'), async (req, res) => {
     try {
         const { displayName } = req.body;
         await renameProject(req.params.projectName, displayName);
@@ -1285,7 +1420,7 @@ app.put('/api/projects/:projectName/rename', authenticateToken, async (req, res)
     }
 });
 // Delete session endpoint
-app.delete('/api/projects/:projectName/sessions/:sessionId', authenticateToken, async (req, res) => {
+app.delete('/api/projects/:projectName/sessions/:sessionId', authenticateToken, requireProjectAccess('editFiles'), async (req, res) => {
     try {
         const { projectName, sessionId } = req.params;
         console.log(`[API] Deleting session: ${sessionId} from project: ${projectName}`);
@@ -1328,7 +1463,7 @@ app.put('/api/sessions/:sessionId/rename', authenticateToken, async (req, res) =
 // Delete project endpoint
 // force=true to allow removal even when sessions exist
 // deleteData=true to also delete session/memory files on disk (destructive)
-app.delete('/api/projects/:projectName', authenticateToken, async (req, res) => {
+app.delete('/api/projects/:projectName', authenticateToken, requireProjectAccess('manageProjectSettings'), async (req, res) => {
     try {
         const { projectName } = req.params;
         const force = req.query.force === 'true';
@@ -1346,7 +1481,7 @@ app.delete('/api/projects/:projectName', authenticateToken, async (req, res) =>
     }
 });
 // Search conversations content (SSE streaming)
-app.get('/api/search/conversations', authenticateToken, async (req, res) => {
+app.get('/api/search/conversations', authenticateToken, requireAdmin, async (req, res) => {
     const query = typeof req.query.q === 'string' ? req.query.q.trim() : '';
     const parsedLimit = Number.parseInt(String(req.query.limit), 10);
     const limit = Number.isNaN(parsedLimit) ? 50 : Math.max(1, Math.min(parsedLimit, 100));
@@ -1539,7 +1674,7 @@ app.post('/api/create-folder', authenticateToken, async (req, res) => {
     }
 });
 // Read file content endpoint
-app.get('/api/projects/:projectName/file', authenticateToken, async (req, res) => {
+app.get('/api/projects/:projectName/file', authenticateToken, requireProjectAccess('viewFiles'), async (req, res) => {
     try {
         const { projectName } = req.params;
         const { filePath } = req.query;
@@ -1576,7 +1711,7 @@ app.get('/api/projects/:projectName/file', authenticateToken, async (req, res) =
     }
 });
 // Serve raw file bytes for previews and downloads.
-app.get('/api/projects/:projectName/files/content', authenticateToken, async (req, res) => {
+app.get('/api/projects/:projectName/files/content', authenticateToken, requireProjectAccess('viewFiles'), async (req, res) => {
     try {
         const { projectName } = req.params;
         const { path: filePath } = req.query;
@@ -1625,7 +1760,7 @@ app.get('/api/projects/:projectName/files/content', authenticateToken, async (re
     }
 });
 // Save file content endpoint
-app.put('/api/projects/:projectName/file', authenticateToken, async (req, res) => {
+app.put('/api/projects/:projectName/file', authenticateToken, requireProjectAccess('editFiles'), async (req, res) => {
     try {
         const { projectName } = req.params;
         const { filePath, content } = req.body;
@@ -1669,7 +1804,7 @@ app.put('/api/projects/:projectName/file', authenticateToken, async (req, res) =
         }
     }
 });
-app.get('/api/projects/:projectName/files', authenticateToken, async (req, res) => {
+app.get('/api/projects/:projectName/files', authenticateToken, requireProjectAccess('viewFiles'), async (req, res) => {
     try {
         // Using fsPromises from import
         // Use extractProjectDirectory to get the actual project path
@@ -1679,8 +1814,12 @@ app.get('/api/projects/:projectName/files', authenticateToken, async (req, res)
         }
         catch (error) {
             console.error('Error extracting project directory:', error);
-            // Fallback to simple dash replacement
-            actualPath = req.params.projectName.replace(/-/g, '/');
+            // Do NOT fall back to projectName.replace(/-/g, '/') here: on Windows the
+            // dash-encoded name ("C--Users-...") decodes to a garbage path ("C//Users/...")
+            // that can never exist, so the old fallback just produced a confusing 404
+            // with a fabricated path. extractProjectDirectory already handles the
+            // POSIX-style decode internally; if it throws, the project is unknown.
+            return res.status(404).json({ error: `Project not found: ${req.params.projectName}` });
         }
         // Check if path exists
         try {
@@ -1742,7 +1881,7 @@ function validateFilename(name) {
     return { valid: true };
 }
 // POST /api/projects/:projectName/files/create - Create new file or directory
-app.post('/api/projects/:projectName/files/create', authenticateToken, async (req, res) => {
+app.post('/api/projects/:projectName/files/create', authenticateToken, requireProjectAccess('editFiles'), async (req, res) => {
     try {
         const { projectName } = req.params;
         const { path: parentPath, type, name } = req.body;
@@ -1815,7 +1954,7 @@ app.post('/api/projects/:projectName/files/create', authenticateToken, async (re
     }
 });
 // PUT /api/projects/:projectName/files/rename - Rename file or directory
-app.put('/api/projects/:projectName/files/rename', authenticateToken, async (req, res) => {
+app.put('/api/projects/:projectName/files/rename', authenticateToken, requireProjectAccess('editFiles'), async (req, res) => {
     try {
         const { projectName } = req.params;
         const { oldPath, newName } = req.body;
@@ -1887,7 +2026,7 @@ app.put('/api/projects/:projectName/files/rename', authenticateToken, async (req
     }
 });
 // DELETE /api/projects/:projectName/files - Delete file or directory
-app.delete('/api/projects/:projectName/files', authenticateToken, async (req, res) => {
+app.delete('/api/projects/:projectName/files', authenticateToken, requireProjectAccess('editFiles'), async (req, res) => {
     try {
         const { projectName } = req.params;
         const { path: targetPath, type } = req.body;
@@ -2097,7 +2236,7 @@ const uploadFilesHandler = async (req, res) => {
         }
     });
 };
-app.post('/api/projects/:projectName/files/upload', authenticateToken, uploadFilesHandler);
+app.post('/api/projects/:projectName/files/upload', authenticateToken, requireProjectAccess('editFiles'), uploadFilesHandler);
 /**
  * Proxy an authenticated client WebSocket to a plugin's internal WS server.
  * Auth is enforced by verifyClient before this function is reached.
@@ -2196,6 +2335,7 @@ function handleChatConnection(ws, request) {
     console.log('[INFO] Chat WebSocket connected');
     // Add to connected clients for project updates
     ws.userId = request?.user?.id ?? request?.user?.userId ?? null;
+    ws.user = request?.user ?? null;
     connectedClients.add(ws);
     // Wrap WebSocket with writer for consistent interface with SSEStreamWriter
     const writer = new WebSocketWriter(ws, request?.user?.id ?? request?.user?.userId ?? null);
@@ -2333,6 +2473,15 @@ function handleChatConnection(ws, request) {
                     });
                 }
             }
+            else if (data.type === 'watch-project') {
+                // Subscribe this client to live file-tree updates for a project
+                // workspace. The server pushes debounced `project_files_updated`
+                // events so the explorer refreshes without HTTP polling.
+                await subscribeToWorkspace(ws, data.projectName);
+            }
+            else if (data.type === 'unwatch-project') {
+                unsubscribeFromWorkspace(ws, data.projectName || null);
+            }
             else if (data.type === 'get-active-sessions') {
                 // Get all currently active sessions
                 const activeSessions = {
@@ -2361,6 +2510,8 @@ function handleChatConnection(ws, request) {
         console.log('🔌 Chat client disconnected');
         // Remove from connected clients
         connectedClients.delete(ws);
+        // Drop any workspace watcher subscriptions held by this socket
+        unsubscribeFromWorkspace(ws);
     });
 }
 // Handle shell WebSocket connections
@@ -2389,6 +2540,15 @@ function handleShellConnection(ws, request) {
                 // is writable, has a git-friendly cwd, and matches where
                 // every provider already stores its config (~/.codex etc.).
                 const projectPath = data.projectPath || os.homedir();
+                const requestedProjectPath = path.resolve(projectPath);
+                if (!userHasProjectAccess(request.user, {
+                    fullPath: requestedProjectPath,
+                    path: requestedProjectPath,
+                    projectPath: requestedProjectPath,
+                }, 'useShell')) {
+                    ws.send(JSON.stringify({ type: 'error', message: 'Shell access denied for this project' }));
+                    return;
+                }
                 const sessionId = data.sessionId;
                 const hasSession = data.hasSession;
                 const provider = data.provider || 'claude';
@@ -2515,7 +2675,7 @@ function handleShellConnection(ws, request) {
                 }));
                 try {
                     // Validate projectPath — resolve to absolute and verify it exists
-                    const resolvedProjectPath = path.resolve(projectPath);
+                    const resolvedProjectPath = requestedProjectPath;
                     try {
                         const stats = fs.statSync(resolvedProjectPath);
                         if (!stats.isDirectory()) {
@@ -2861,7 +3021,7 @@ function handleShellConnection(ws, request) {
     });
 }
 // Image upload endpoint
-app.post('/api/projects/:projectName/upload-images', authenticateToken, async (req, res) => {
+app.post('/api/projects/:projectName/upload-images', authenticateToken, requireProjectAccess('editFiles'), async (req, res) => {
     try {
         const multer = (await import('multer')).default;
         const path = (await import('path')).default;
@@ -2937,7 +3097,7 @@ app.post('/api/projects/:projectName/upload-images', authenticateToken, async (r
     }
 });
 // Get token usage for a specific session
-app.get('/api/projects/:projectName/sessions/:sessionId/token-usage', authenticateToken, async (req, res) => {
+app.get('/api/projects/:projectName/sessions/:sessionId/token-usage', authenticateToken, requireProjectAccess('viewFiles'), async (req, res) => {
     try {
         const { projectName, sessionId } = req.params;
         const { provider = 'claude' } = req.query;