@shawnstack/quickforge 1.3.24 → 1.3.25

package/server/message-converters.mjs

@@ -0,0 +1,79 @@
+/**
+ * LLM message format converters.
+ *
+ * Pure functions that transform AgentMessage[] to LLM-compatible Message[]
+ * and extract text content from messages. No module-level state.
+ */
+
+/**
+ * Strip the `details` property from a message object.
+ * Returns a shallow copy so the original message is not mutated.
+ */
+export function omitDetailsForLlm(message) {
+  if (!message || typeof message !== 'object' || message.details === undefined) return message
+  const copy = { ...message }
+  delete copy.details
+  return copy
+}
+
+/**
+ * Convert AgentMessage[] to LLM-compatible Message[].
+ * Handles "user-with-attachments" → "user" with multi-modal content blocks.
+ * Without this the default pi-agent-core convertToLlm silently drops
+ * user-with-attachments messages, so the LLM never sees attachments.
+ */
+export function serverConvertToLlm(messages) {
+  return messages
+    .filter(m => m.role !== 'artifact')
+    .map(m => {
+      if (m.role === 'user-with-attachments') {
+        const textContent = typeof m.content === 'string'
+          ? [{ type: 'text', text: m.content }]
+          : [...m.content]
+        if (Array.isArray(m.attachments)) {
+          for (const att of m.attachments) {
+            if (att.type === 'image' && att.content) {
+              textContent.push({ type: 'image', data: att.content, mimeType: att.mimeType })
+            } else if (att.type === 'document' && att.extractedText) {
+              textContent.push({ type: 'text', text: `\n\n[Document: ${att.fileName}]\n${att.extractedText}` })
+            }
+          }
+        }
+        return omitDetailsForLlm({ ...m, role: 'user', content: textContent })
+      }
+      if (m.role === 'user' || m.role === 'assistant' || m.role === 'toolResult') return omitDetailsForLlm(m)
+      return null
+    })
+    .filter(Boolean)
+}
+
+/**
+ * Extract plain text content from a message object.
+ * Handles string content and ContentBlock[] arrays.
+ */
+export function messageText(message) {
+  const content = message?.content
+  if (typeof content === 'string') return content
+  if (Array.isArray(content)) {
+    return content
+      .filter((block) => block?.type === 'text')
+      .map((block) => block.text ?? '')
+      .join('\n')
+      .trim()
+  }
+  return ''
+}
+
+/**
+ * Find the last assistant message with non-empty text content.
+ * Returns the text string, or '' if no assistant text is found.
+ */
+export function lastAssistantText(messages) {
+  for (let index = messages.length - 1; index >= 0; index--) {
+    const message = messages[index]
+    if (message?.role !== 'assistant') continue
+    const text = messageText(message)
+    if (text) return text
+  }
+  return ''
+}

package/server/routes/agent-profiles.mjs

@@ -1,4 +1,4 @@
-import { streamSimple } from '@mariozechner/pi-ai'
+import { streamSimple } from '@earendil-works/pi-ai'
 import { sendJson, readJsonBody, decodeSegment } from '../utils/response.mjs'
 import { readStore } from '../storage.mjs'
 import { logger } from '../utils/logger.mjs'

package/server/routes/filesystem.mjs

@@ -50,9 +50,21 @@ async function getFilesystemRoots() {
   return roots
 }
 
-async function listFilesystemDirectories(inputPath) {
+async function listFilesystemDirectories(inputPath, allowedRoots) {
   const requestedPath = String(inputPath || os.homedir())
   const resolved = path.resolve(requestedPath)
+
+  // Only allow browsing within or at known filesystem roots
+  const isAllowed = allowedRoots.some((root) => {
+    const rel = path.relative(root, resolved)
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel))
+  })
+  if (!isAllowed) {
+    const error = new Error('Access denied: path is outside allowed roots')
+    error.statusCode = 403
+    throw error
+  }
+
   await assertDirectory(resolved)
 
   const entries = await fs.readdir(resolved, { withFileTypes: true }).catch((error) => {
@@ -77,7 +89,11 @@ export async function handleFilesystemApi(req, res, url) {
   }
 
   if (req.method === 'GET' && url.pathname === '/api/filesystem/directories') {
-    sendJson(res, 200, await listFilesystemDirectories(url.searchParams.get('path')))
+    const roots = await getFilesystemRoots()
+    const allowedRootPaths = roots.map((r) => path.resolve(r.path))
+    // Always allow browsing from home directory as a fallback
+    allowedRootPaths.push(os.homedir())
+    sendJson(res, 200, await listFilesystemDirectories(url.searchParams.get('path'), allowedRootPaths))
     return
   }
 

package/server/routes/scheduled-tasks.mjs

@@ -1,4 +1,4 @@
-import { streamSimple } from '@mariozechner/pi-ai'
+import { streamSimple } from '@earendil-works/pi-ai'
 import { readJsonBody, sendJson, decodeSegment } from '../utils/response.mjs'
 import { readStore, atomicUpdate } from '../storage.mjs'
 import { createAgent, getSessionEventBus, agentEvents, persistSessionState } from '../agent-manager.mjs'

package/server/routes/storage.mjs

@@ -1,8 +1,72 @@
 import path from 'node:path'
 import { sendJson, readJsonBody, decodeSegment } from '../utils/response.mjs'
-import { readStore, writeStore, atomicUpdate, getComparable, readSessionStoreScoped, readSessionValue, writeSessionValue, deleteSessionValue, ensureStorage, dataDir, configDir, storageDir, cacheDir, logsDir } from '../storage.mjs'
+import { readStore, writeStore, atomicUpdate, getComparable, getStoreRevision, readSessionStoreScoped, readSessionValue, writeSessionValue, deleteSessionValue, ensureStorage, dataDir, configDir, storageDir, cacheDir, logsDir } from '../storage.mjs'
 import { directorySize } from '../utils/workspace.mjs'
 
+const metadataIndexCache = new Map()
+const MAX_METADATA_INDEX_CACHE_ENTRIES = 50
+
+function metadataIndexCacheKey({ scope, projectId, indexName, direction }) {
+  return JSON.stringify({ scope: scope || '', projectId: projectId || '', indexName, direction })
+}
+
+function sortIndexedValues(values, store, indexName, direction) {
+  values.sort((a, b) => {
+    if (store === 'sessions-metadata' && indexName === 'lastModified') {
+      const leftPinned = getComparable(a, 'pinnedAt')
+      const rightPinned = getComparable(b, 'pinnedAt')
+      if (leftPinned !== rightPinned) {
+        if (leftPinned === undefined || leftPinned === null) return 1
+        if (rightPinned === undefined || rightPinned === null) return -1
+        return -String(leftPinned).localeCompare(String(rightPinned))
+      }
+    }
+
+    const left = getComparable(a, indexName)
+    const right = getComparable(b, indexName)
+    if (left === right) return 0
+    if (left === undefined || left === null) return direction === 'desc' ? 1 : -1
+    if (right === undefined || right === null) return direction === 'desc' ? -1 : 1
+    const result = String(left).localeCompare(String(right))
+    return direction === 'desc' ? -result : result
+  })
+  return values
+}
+
+async function readIndexedValues(store, indexName, direction, scope, projectId) {
+  if (store !== 'sessions-metadata') {
+    let data
+    if (scope && store === 'sessions') {
+      data = await readSessionStoreScoped(store, scope, scope === 'project' ? projectId : undefined)
+    } else {
+      data = await readStore(store)
+    }
+    return sortIndexedValues(Object.values(data), store, indexName, direction)
+  }
+
+  const revision = getStoreRevision(store)
+  const key = metadataIndexCacheKey({ scope, projectId, indexName, direction })
+  const cached = metadataIndexCache.get(key)
+  if (cached && cached.revision === revision) return cached.values
+
+  const data = scope
+    ? await readSessionStoreScoped(store, scope, scope === 'project' ? projectId : undefined)
+    : await readStore(store)
+  const values = sortIndexedValues(
+    Object.values(data).filter((value) => value?.messageCount !== 0),
+    store,
+    indexName,
+    direction,
+  )
+
+  metadataIndexCache.set(key, { revision, values })
+  if (metadataIndexCache.size > MAX_METADATA_INDEX_CACHE_ENTRIES) {
+    const firstKey = metadataIndexCache.keys().next().value
+    if (firstKey) metadataIndexCache.delete(firstKey)
+  }
+  return values
+}
+
 export async function handleStorageApi(req, res, url) {
   const parts = url.pathname.split('/').filter(Boolean)
 
@@ -44,36 +108,7 @@ export async function handleStorageApi(req, res, url) {
 
     await ensureStorage()
 
-    let data
-    if (scope && (store === 'sessions' || store === 'sessions-metadata')) {
-      data = await readSessionStoreScoped(store, scope, scope === 'project' ? projectId : undefined)
-    } else {
-      data = await readStore(store)
-    }
-
-    let values = Object.values(data)
-    if (store === 'sessions-metadata') {
-      values = values.filter((value) => value?.messageCount !== 0)
-    }
-    values.sort((a, b) => {
-      if (store === 'sessions-metadata' && indexName === 'lastModified') {
-        const leftPinned = getComparable(a, 'pinnedAt')
-        const rightPinned = getComparable(b, 'pinnedAt')
-        if (leftPinned !== rightPinned) {
-          if (leftPinned === undefined || leftPinned === null) return 1
-          if (rightPinned === undefined || rightPinned === null) return -1
-          return -String(leftPinned).localeCompare(String(rightPinned))
-        }
-      }
-
-      const left = getComparable(a, indexName)
-      const right = getComparable(b, indexName)
-      if (left === right) return 0
-      if (left === undefined || left === null) return direction === 'desc' ? 1 : -1
-      if (right === undefined || right === null) return direction === 'desc' ? -1 : 1
-      const result = String(left).localeCompare(String(right))
-      return direction === 'desc' ? -result : result
-    })
+    const values = await readIndexedValues(store, indexName, direction, scope, projectId)
 
     const total = values.length
     const limit = limitParam ? parseInt(limitParam, 10) : undefined

package/server/session-utils.mjs

@@ -1,4 +1,4 @@
-import { streamSimple } from '@mariozechner/pi-ai'
+import { streamSimple } from '@earendil-works/pi-ai'
 import { buildInstructionsPayload } from './project-config.mjs'
 import { composeSystemPrompt } from './system-prompt.mjs'
 import { listSubagentProfiles } from './agent-profiles.mjs'

package/server/storage.mjs

@@ -62,6 +62,17 @@ export const stores = new Set([
 const sessionBucketIndex = new Map()
 let bucketIndexBuilt = false
 
+// Monotonic in-process revisions for cache invalidation in route-level indexes.
+const storeRevisions = new Map()
+
+function bumpStoreRevision(storeName) {
+  storeRevisions.set(storeName, (storeRevisions.get(storeName) || 0) + 1)
+}
+
+export function getStoreRevision(storeName) {
+  return storeRevisions.get(storeName) || 0
+}
+
 const configStores = new Set(['settings', 'provider-keys', 'custom-providers'])
 const sessionStores = new Set(['sessions', 'sessions-metadata'])
 
@@ -370,6 +381,34 @@ async function readAllSessionValues() {
   return result
 }
 
+function sessionMetadataQueueName(bucket) {
+  return bucket.scope === 'project' ? `sessions-metadata:${bucket.projectId}` : 'sessions-metadata:global'
+}
+
+function sameSessionBucket(left, right) {
+  if (!left || !right) return false
+  return left.scope === right.scope && (left.projectId || undefined) === (right.projectId || undefined)
+}
+
+function updateSessionMetadataBucketIndex(bucket, previousData, nextData) {
+  const ids = new Set([
+    ...Object.keys(previousData || {}),
+    ...Object.keys(nextData || {}),
+  ])
+
+  for (const sessionId of ids) {
+    const meta = nextData?.[sessionId]
+    if (meta && typeof meta === 'object') {
+      sessionBucketIndex.set(sessionId, sessionBucket(meta))
+      continue
+    }
+
+    if (sameSessionBucket(sessionBucketIndex.get(sessionId), bucket)) {
+      sessionBucketIndex.delete(sessionId)
+    }
+  }
+}
+
 async function writeSessionValueFile(sessionId, value) {
   await writeJsonAtomic(sessionDataFile(sessionId, sessionBucket(value)), value)
   // Keep in-memory index current
@@ -497,6 +536,15 @@ async function writeSessionStore(storeName, data) {
     filesToWrite.add(sessionStoreFile(storeName, bucket))
   }
 
+  const previousByFile = new Map()
+  if (storeName === 'sessions-metadata') {
+    await Promise.all(
+      [...filesToWrite].map(async (file) => {
+        previousByFile.set(file, await readJsonFile(file, {}))
+      }),
+    )
+  }
+
   await Promise.all(
     [...filesToWrite].map(async (file) => {
       const bucketEntry = [...buckets.values()].find((entry) => sessionStoreFile(storeName, entry.bucket) === file)
@@ -506,9 +554,14 @@ async function writeSessionStore(storeName, data) {
 
   // Keep in-memory bucket index current for metadata writes
   if (storeName === 'sessions-metadata') {
-    for (const [sessionId, meta] of Object.entries(data || {})) {
-      if (meta && typeof meta === 'object') sessionBucketIndex.set(sessionId, sessionBucket(meta))
+    for (const file of filesToWrite) {
+      const bucketEntry = [...buckets.values()].find((entry) => sessionStoreFile(storeName, entry.bucket) === file)
+      const bucket = bucketEntry?.bucket ?? (file === sessionStoreFile(storeName, { scope: 'global' })
+        ? { scope: 'global' }
+        : { scope: 'project', projectId: path.basename(path.dirname(file)) })
+      updateSessionMetadataBucketIndex(bucket, previousByFile.get(file) ?? {}, bucketEntry?.data ?? {})
     }
+    bumpStoreRevision(storeName)
   }
 }
 
@@ -607,6 +660,29 @@ export async function atomicUpdate(storeName, updateFn) {
   })
 }
 
+/**
+ * Atomically read-modify-write the scoped sessions metadata file within its serialized write queue.
+ *
+ * @param {string} scope
+ * @param {string|null|undefined} projectId
+ * @param {(data: object) => object} updateFn — receives current scoped metadata, returns updated metadata
+ * @returns {Promise<object>} the updated scoped metadata
+ */
+export async function atomicSessionMetadataUpdate(scope, projectId, updateFn) {
+  const bucket = scope === 'project' ? { scope: 'project', projectId } : { scope: 'global' }
+  const file = sessionStoreFile('sessions-metadata', bucket)
+  return enqueueWrite(sessionMetadataQueueName(bucket), async () => {
+    await ensureStorage()
+    const data = await readJsonFile(file, {})
+    const previousData = { ...data }
+    const updated = updateFn(data)
+    await writeJsonAtomic(file, updated)
+    updateSessionMetadataBucketIndex(bucket, previousData, updated)
+    bumpStoreRevision('sessions-metadata')
+    return updated
+  })
+}
+
 /**
  * Atomically read-modify-write the project config within the config queue.
  */

package/server/tool-wiring.mjs

@@ -0,0 +1,87 @@
+/**
+ * Tool definition wrapping and execution wiring.
+ *
+ * Wraps raw tool definitions with execution handlers that inject
+ * timing metadata, permission checks, and context.
+ */
+
+import { toolHandlers } from './tools/index.mjs'
+import { callMcpTool } from './mcp/registry.mjs'
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+export function isPlainObject(value) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value))
+}
+
+export function mergeQuickForgeTiming(details, timing) {
+  if (!isPlainObject(details)) return { quickforgeTiming: timing }
+  return { ...details, quickforgeTiming: timing }
+}
+
+// ---------------------------------------------------------------------------
+// Tool wrappers
+// ---------------------------------------------------------------------------
+
+export function wrapToolDefinition(definition, context, toolPermissions) {
+  const handler = toolHandlers[definition.name]
+  if (!handler) throw new Error(`Missing handler for tool: ${definition.name}`)
+  return {
+    ...definition,
+    execute: async (_toolCallId, params, signal, onUpdate) => {
+      if (toolPermissions) {
+        const permissionError = toolPermissions(definition.name)
+        if (permissionError) throw new Error(permissionError)
+      }
+
+      const startedAt = Date.now()
+      const startedAtPerf = performance.now()
+      const result = await handler(params || {}, context, { signal, onUpdate, toolCallId: _toolCallId })
+      const finishedAt = Date.now()
+      const durationMs = Math.max(0, Math.round(performance.now() - startedAtPerf))
+      const details = mergeQuickForgeTiming(result.details, { startedAt, finishedAt, durationMs })
+      return {
+        content: [{ type: 'text', text: result.content }],
+        details: isPlainObject(details) ? { ...details, toolCallId: _toolCallId } : details,
+      }
+    },
+  }
+}
+
+export function wrapMcpToolDefinition(definition, toolPermissions) {
+  return {
+    ...definition,
+    execute: async (_toolCallId, params) => {
+      if (toolPermissions) {
+        const permissionError = toolPermissions(definition.name)
+        if (permissionError) throw new Error(permissionError)
+      }
+
+      const startedAt = Date.now()
+      const startedAtPerf = performance.now()
+      const result = await callMcpTool(definition.name, params || {})
+      const finishedAt = Date.now()
+      const durationMs = Math.max(0, Math.round(performance.now() - startedAtPerf))
+      if (result.isError) {
+        throw new Error(result.content || `MCP tool failed: ${definition.name}`)
+      }
+      return {
+        content: [{ type: 'text', text: result.content }],
+        details: mergeQuickForgeTiming(result.details, { startedAt, finishedAt, durationMs }),
+      }
+    },
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Skill context
+// ---------------------------------------------------------------------------
+
+export function sessionSkillsContext(session) {
+  return {
+    globalSkillNames: session.globalSkillNames,
+    projectSkillNames: session.projectSkillNames,
+  }
+}

package/server/utils/workspace.mjs

@@ -131,21 +131,40 @@ export async function assertDirectory(dir) {
   }
 }
 
+const SIZE_SKIP_DIRS = new Set(['.git', 'node_modules', 'dist', 'dist-ssr', '.vite', '.cache', '.next', '.nuxt', '__pycache__', '.venv', 'venv'])
+const directorySizeCache = new Map()
+const DIRECTORY_SIZE_CACHE_TTL_MS = 10_000
+
 export async function directorySize(dir) {
   try {
+    const now = Date.now()
+    const cached = directorySizeCache.get(dir)
+    if (cached && now - cached.ts < DIRECTORY_SIZE_CACHE_TTL_MS) return cached.size
+
     const entries = await fs.readdir(dir, { withFileTypes: true })
     const sizes = await Promise.all(entries.map(async (entry) => {
+      if (entry.isDirectory() && SIZE_SKIP_DIRS.has(entry.name)) return 0
       const full = path.join(dir, entry.name)
       if (entry.isDirectory()) return directorySize(full)
       const stat = await fs.stat(full)
       return stat.size
     }))
-    return sizes.reduce((sum, value) => sum + value, 0)
+    const size = sizes.reduce((sum, value) => sum + value, 0)
+    directorySizeCache.set(dir, { size, ts: now })
+    return size
   } catch {
     return 0
   }
 }
 
+export function invalidateDirectorySizeCache(dir) {
+  if (dir) {
+    directorySizeCache.delete(dir)
+  } else {
+    directorySizeCache.clear()
+  }
+}
+
 export function shouldSkipSearchDir(name) {
   return ['.git', 'node_modules', 'dist', 'dist-ssr', '.vite'].includes(name)
 }