@pixelbyte-software/pixcode 1.54.7 → 1.54.9

package/server/routes/mcp-utils.js

@@ -1,13 +1,13 @@
-/**
- * MCP UTILITIES API ROUTES
- * ========================
- * 
- * API endpoints for MCP server detection and configuration utilities.
- * These endpoints expose centralized MCP detection functionality.
- */
-
-import express from 'express';
-
-const router = express.Router();
-
-export default router;
+/**
+ * MCP UTILITIES API ROUTES
+ * ========================
+ * 
+ * API endpoints for MCP server detection and configuration utilities.
+ * These endpoints expose centralized MCP detection functionality.
+ */
+
+import express from 'express';
+
+const router = express.Router();
+
+export default router;

package/server/routes/messages.js

@@ -1,97 +1,97 @@
-/**
- * Unified messages endpoint.
- *
- * GET /api/sessions/:sessionId/messages?provider=claude&projectName=foo&limit=50&offset=0
- *
- * Replaces the four provider-specific session message endpoints with a single route
- * that delegates to the appropriate adapter via the provider registry.
- *
- * @module routes/messages
- */
-
-import path from 'node:path';
-
-import express from 'express';
-
-import { sessionsService } from '../modules/providers/services/sessions.service.js';
-import { userHasProjectAccess } from '../services/platformization.js';
-import { appConfigDb } from '../database/db.js';
-
-const router = express.Router();
-const SESSION_OWNERSHIP_KEY = 'session_ownership';
-
-function readSessionOwnership() {
-  try {
-    return JSON.parse(appConfigDb.get(SESSION_OWNERSHIP_KEY) || '{}');
-  } catch {
-    return {};
-  }
-}
-
-function canUserReadSession(user, provider, sessionId) {
-  if (['admin', 'owner'].includes(user?.role)) return true;
-  const owner = readSessionOwnership()[`${provider || 'claude'}:${sessionId}`];
-  return Boolean(owner?.userId && Number(owner.userId) === Number(user?.id ?? user?.userId));
-}
-
-/**
- * GET /api/sessions/:sessionId/messages
- *
- * Auth: authenticateToken applied at mount level in index.js
- *
- * Query params:
- *   provider    - 'claude' | 'cursor' | 'codex' | 'gemini' (default: 'claude')
- *   projectName - required for claude provider
- *   projectPath - required for cursor provider (absolute path used for cwdId hash)
- *   limit       - page size (omit or null for all)
- *   offset      - pagination offset (default: 0)
- */
-router.get('/:sessionId/messages', async (req, res) => {
-  try {
-    const { sessionId } = req.params;
-    const provider = String(req.query.provider || 'claude').trim().toLowerCase();
-    const projectName = req.query.projectName || '';
-    const projectPath = req.query.projectPath || '';
-    const limitParam = req.query.limit;
-    const limit = limitParam !== undefined && limitParam !== null && limitParam !== ''
-      ? parseInt(limitParam, 10)
-      : null;
-    const offset = parseInt(req.query.offset || '0', 10);
-
-    const availableProviders = sessionsService.listProviderIds();
-    if (!availableProviders.includes(provider)) {
-      const available = availableProviders.join(', ');
-      return res.status(400).json({ error: `Unknown provider: ${provider}. Available: ${available}` });
-    }
-
-    if (!projectName && !projectPath) {
-      return res.status(400).json({ error: 'projectName or projectPath is required' });
-    }
-
-    const projectRef = projectName
-      ? { name: String(projectName), projectName: String(projectName) }
-      : { fullPath: path.resolve(String(projectPath)), path: path.resolve(String(projectPath)), projectPath: path.resolve(String(projectPath)) };
-
-    if (!userHasProjectAccess(req.user, projectRef, 'viewFiles')) {
-      return res.status(403).json({ error: 'Project access denied.' });
-    }
-
-    if (!canUserReadSession(req.user, provider, sessionId)) {
-      return res.status(403).json({ error: 'Session access denied.' });
-    }
-
-    const result = await sessionsService.fetchHistory(provider, sessionId, {
-      projectName,
-      projectPath,
-      limit,
-      offset,
-    });
-
-    return res.json(result);
-  } catch (error) {
-    console.error('Error fetching unified messages:', error);
-    return res.status(500).json({ error: 'Failed to fetch messages' });
-  }
-});
-
-export default router;
+/**
+ * Unified messages endpoint.
+ *
+ * GET /api/sessions/:sessionId/messages?provider=claude&projectName=foo&limit=50&offset=0
+ *
+ * Replaces the four provider-specific session message endpoints with a single route
+ * that delegates to the appropriate adapter via the provider registry.
+ *
+ * @module routes/messages
+ */
+
+import path from 'node:path';
+
+import express from 'express';
+
+import { sessionsService } from '../modules/providers/services/sessions.service.js';
+import { userHasProjectAccess } from '../services/platformization.js';
+import { appConfigDb } from '../database/db.js';
+
+const router = express.Router();
+const SESSION_OWNERSHIP_KEY = 'session_ownership';
+
+function readSessionOwnership() {
+  try {
+    return JSON.parse(appConfigDb.get(SESSION_OWNERSHIP_KEY) || '{}');
+  } catch {
+    return {};
+  }
+}
+
+function canUserReadSession(user, provider, sessionId) {
+  if (['admin', 'owner'].includes(user?.role)) return true;
+  const owner = readSessionOwnership()[`${provider || 'claude'}:${sessionId}`];
+  return Boolean(owner?.userId && Number(owner.userId) === Number(user?.id ?? user?.userId));
+}
+
+/**
+ * GET /api/sessions/:sessionId/messages
+ *
+ * Auth: authenticateToken applied at mount level in index.js
+ *
+ * Query params:
+ *   provider    - 'claude' | 'cursor' | 'codex' | 'gemini' (default: 'claude')
+ *   projectName - required for claude provider
+ *   projectPath - required for cursor provider (absolute path used for cwdId hash)
+ *   limit       - page size (omit or null for all)
+ *   offset      - pagination offset (default: 0)
+ */
+router.get('/:sessionId/messages', async (req, res) => {
+  try {
+    const { sessionId } = req.params;
+    const provider = String(req.query.provider || 'claude').trim().toLowerCase();
+    const projectName = req.query.projectName || '';
+    const projectPath = req.query.projectPath || '';
+    const limitParam = req.query.limit;
+    const limit = limitParam !== undefined && limitParam !== null && limitParam !== ''
+      ? parseInt(limitParam, 10)
+      : null;
+    const offset = parseInt(req.query.offset || '0', 10);
+
+    const availableProviders = sessionsService.listProviderIds();
+    if (!availableProviders.includes(provider)) {
+      const available = availableProviders.join(', ');
+      return res.status(400).json({ error: `Unknown provider: ${provider}. Available: ${available}` });
+    }
+
+    if (!projectName && !projectPath) {
+      return res.status(400).json({ error: 'projectName or projectPath is required' });
+    }
+
+    const projectRef = projectName
+      ? { name: String(projectName), projectName: String(projectName) }
+      : { fullPath: path.resolve(String(projectPath)), path: path.resolve(String(projectPath)), projectPath: path.resolve(String(projectPath)) };
+
+    if (!userHasProjectAccess(req.user, projectRef, 'viewFiles')) {
+      return res.status(403).json({ error: 'Project access denied.' });
+    }
+
+    if (!canUserReadSession(req.user, provider, sessionId)) {
+      return res.status(403).json({ error: 'Session access denied.' });
+    }
+
+    const result = await sessionsService.fetchHistory(provider, sessionId, {
+      projectName,
+      projectPath,
+      limit,
+      offset,
+    });
+
+    return res.json(result);
+  } catch (error) {
+    console.error('Error fetching unified messages:', error);
+    return res.status(500).json({ error: 'Failed to fetch messages' });
+  }
+});
+
+export default router;

package/server/routes/network.js

@@ -1,143 +1,143 @@
-import os from 'os';
-
-import express from 'express';
-
-import {
-  getTunnelState,
-  getUpnpState,
-  startTunnel,
-  stopTunnel,
-} from '../services/external-access.js';
-import { requireAdmin } from '../middleware/auth.js';
-
-const router = express.Router();
-
-// Accept any env key the rest of the server honors. Keep this aligned with server/cli.js.
-const resolveServerPort = () => {
-  const raw = process.env.SERVER_PORT || process.env.PORT || '3001';
-  const port = Number(raw);
-  return Number.isFinite(port) && port > 0 ? port : 3001;
-};
-
-const PRIVATE_IPV4_REGEX = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[0-1])\.)/u;
-const VIRTUAL_INTERFACE_REGEX = /(docker|veth|bridge|br-|vmnet|vbox|virtualbox|tailscale|utun|wg|tun|tap|zerotier|zt)/iu;
-
-const classifyEndpoint = (ifaceName, address) => {
-  const isPrivate = PRIVATE_IPV4_REGEX.test(address);
-  const isVirtual = VIRTUAL_INTERFACE_REGEX.test(ifaceName);
-  return {
-    scope: isPrivate ? 'private' : 'public',
-    kind: isVirtual ? 'virtual' : (isPrivate ? 'lan' : 'public'),
-    usableForSameNetwork: isPrivate && !isVirtual,
-  };
-};
-
-// Filter to usable LAN addresses. We skip:
-//  - internal (loopback) addresses, since QR-ing "127.0.0.1" is useless for a phone
-//  - link-local IPv6, since pasting "fe80::…%iface" into a phone browser won't resolve
-//  - IPv6 addresses in general for the first pass (most users want the v4 QR)
-const listLanEndpoints = () => {
-  const interfaces = os.networkInterfaces();
-  const endpoints = [];
-
-  for (const [ifaceName, addrs] of Object.entries(interfaces)) {
-    if (!addrs) continue;
-    for (const addr of addrs) {
-      if (addr.internal) continue;
-      if (addr.family !== 'IPv4' && addr.family !== 4) continue;
-      const classification = classifyEndpoint(ifaceName, addr.address);
-      if (!classification.usableForSameNetwork) continue;
-      endpoints.push({
-        host: addr.address,
-        label: ifaceName,
-        family: 'IPv4',
-        ...classification,
-      });
-    }
-  }
-
-  return endpoints;
-};
-
-router.get('/endpoints', (req, res) => {
-  try {
-    const port = resolveServerPort();
-    const endpoints = listLanEndpoints().map((entry) => ({
-      ...entry,
-      url: `http://${entry.host}:${port}`,
-    }));
-
-    res.json({
-      port,
-      hostname: os.hostname(),
-      endpoints,
-    });
-  } catch (error) {
-    console.error('Error listing network endpoints:', error);
-    res.status(500).json({ error: 'Failed to list network endpoints' });
-  }
-});
-
-// ============================================================================
-// External access (UPnP + tunnel)
-// ============================================================================
-
-router.get('/external', (req, res) => {
-  try {
-    res.json({
-      upnp: getUpnpState(),
-      tunnel: getTunnelState(),
-    });
-  } catch (error) {
-    console.error('Error reading external-access state:', error);
-    res.status(500).json({ error: 'Failed to read external access state' });
-  }
-});
-
-// UPnP endpoints removed in v1.32 (see external-access.js for rationale).
-// Clients hitting /upnp get a 410 so the UI can show a clear "moved to
-// tunnel" hint without mistaking the absence for a transient 404.
-router.post('/upnp', (_req, res) => {
-  res.status(410).json({
-    error: 'UPnP removed in v1.32 — use cloudflared or ngrok tunnels instead',
-    upnp: getUpnpState(),
-  });
-});
-router.delete('/upnp', (_req, res) => {
-  res.status(410).json({
-    error: 'UPnP removed in v1.32 — use cloudflared or ngrok tunnels instead',
-    upnp: getUpnpState(),
-  });
-});
-
-router.post('/tunnel', requireAdmin, async (req, res) => {
-  const port = resolveServerPort();
-  try {
-    const provider = req.body?.provider === 'ngrok' ? 'ngrok' : 'cloudflare';
-    const state = await startTunnel({ port, provider, persistPreference: true });
-    res.json({ success: true, tunnel: state });
-  } catch (error) {
-    console.error('Tunnel start failed:', error);
-    // 424 Failed Dependency is the best match for "we can't start because a
-    // required external binary is missing" — it tells the UI to show the
-    // "install cloudflared/ngrok" hint rather than a generic server error.
-    const status = error?.code === 'ENOENT_TUNNEL' ? 424 : 502;
-    res.status(status).json({
-      error: error?.message || 'Tunnel start failed',
-      installHint: error?.installHint,
-      tunnel: getTunnelState(),
-    });
-  }
-});
-
-router.delete('/tunnel', requireAdmin, async (req, res) => {
-  try {
-    const state = await stopTunnel({ persistPreference: true });
-    res.json({ success: true, tunnel: state });
-  } catch (error) {
-    console.error('Tunnel stop failed:', error);
-    res.status(502).json({ error: error?.message || 'Tunnel stop failed', tunnel: getTunnelState() });
-  }
-});
-
-export default router;
+import os from 'os';
+
+import express from 'express';
+
+import {
+  getTunnelState,
+  getUpnpState,
+  startTunnel,
+  stopTunnel,
+} from '../services/external-access.js';
+import { requireAdmin } from '../middleware/auth.js';
+
+const router = express.Router();
+
+// Accept any env key the rest of the server honors. Keep this aligned with server/cli.js.
+const resolveServerPort = () => {
+  const raw = process.env.SERVER_PORT || process.env.PORT || '3001';
+  const port = Number(raw);
+  return Number.isFinite(port) && port > 0 ? port : 3001;
+};
+
+const PRIVATE_IPV4_REGEX = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[0-1])\.)/u;
+const VIRTUAL_INTERFACE_REGEX = /(docker|veth|bridge|br-|vmnet|vbox|virtualbox|tailscale|utun|wg|tun|tap|zerotier|zt)/iu;
+
+const classifyEndpoint = (ifaceName, address) => {
+  const isPrivate = PRIVATE_IPV4_REGEX.test(address);
+  const isVirtual = VIRTUAL_INTERFACE_REGEX.test(ifaceName);
+  return {
+    scope: isPrivate ? 'private' : 'public',
+    kind: isVirtual ? 'virtual' : (isPrivate ? 'lan' : 'public'),
+    usableForSameNetwork: isPrivate && !isVirtual,
+  };
+};
+
+// Filter to usable LAN addresses. We skip:
+//  - internal (loopback) addresses, since QR-ing "127.0.0.1" is useless for a phone
+//  - link-local IPv6, since pasting "fe80::…%iface" into a phone browser won't resolve
+//  - IPv6 addresses in general for the first pass (most users want the v4 QR)
+const listLanEndpoints = () => {
+  const interfaces = os.networkInterfaces();
+  const endpoints = [];
+
+  for (const [ifaceName, addrs] of Object.entries(interfaces)) {
+    if (!addrs) continue;
+    for (const addr of addrs) {
+      if (addr.internal) continue;
+      if (addr.family !== 'IPv4' && addr.family !== 4) continue;
+      const classification = classifyEndpoint(ifaceName, addr.address);
+      if (!classification.usableForSameNetwork) continue;
+      endpoints.push({
+        host: addr.address,
+        label: ifaceName,
+        family: 'IPv4',
+        ...classification,
+      });
+    }
+  }
+
+  return endpoints;
+};
+
+router.get('/endpoints', (req, res) => {
+  try {
+    const port = resolveServerPort();
+    const endpoints = listLanEndpoints().map((entry) => ({
+      ...entry,
+      url: `http://${entry.host}:${port}`,
+    }));
+
+    res.json({
+      port,
+      hostname: os.hostname(),
+      endpoints,
+    });
+  } catch (error) {
+    console.error('Error listing network endpoints:', error);
+    res.status(500).json({ error: 'Failed to list network endpoints' });
+  }
+});
+
+// ============================================================================
+// External access (UPnP + tunnel)
+// ============================================================================
+
+router.get('/external', (req, res) => {
+  try {
+    res.json({
+      upnp: getUpnpState(),
+      tunnel: getTunnelState(),
+    });
+  } catch (error) {
+    console.error('Error reading external-access state:', error);
+    res.status(500).json({ error: 'Failed to read external access state' });
+  }
+});
+
+// UPnP endpoints removed in v1.32 (see external-access.js for rationale).
+// Clients hitting /upnp get a 410 so the UI can show a clear "moved to
+// tunnel" hint without mistaking the absence for a transient 404.
+router.post('/upnp', (_req, res) => {
+  res.status(410).json({
+    error: 'UPnP removed in v1.32 — use cloudflared or ngrok tunnels instead',
+    upnp: getUpnpState(),
+  });
+});
+router.delete('/upnp', (_req, res) => {
+  res.status(410).json({
+    error: 'UPnP removed in v1.32 — use cloudflared or ngrok tunnels instead',
+    upnp: getUpnpState(),
+  });
+});
+
+router.post('/tunnel', requireAdmin, async (req, res) => {
+  const port = resolveServerPort();
+  try {
+    const provider = req.body?.provider === 'ngrok' ? 'ngrok' : 'cloudflare';
+    const state = await startTunnel({ port, provider, persistPreference: true });
+    res.json({ success: true, tunnel: state });
+  } catch (error) {
+    console.error('Tunnel start failed:', error);
+    // 424 Failed Dependency is the best match for "we can't start because a
+    // required external binary is missing" — it tells the UI to show the
+    // "install cloudflared/ngrok" hint rather than a generic server error.
+    const status = error?.code === 'ENOENT_TUNNEL' ? 424 : 502;
+    res.status(status).json({
+      error: error?.message || 'Tunnel start failed',
+      installHint: error?.installHint,
+      tunnel: getTunnelState(),
+    });
+  }
+});
+
+router.delete('/tunnel', requireAdmin, async (req, res) => {
+  try {
+    const state = await stopTunnel({ persistPreference: true });
+    res.json({ success: true, tunnel: state });
+  } catch (error) {
+    console.error('Tunnel stop failed:', error);
+    res.status(502).json({ error: error?.message || 'Tunnel stop failed', tunnel: getTunnelState() });
+  }
+});
+
+export default router;