aicodeman 1.5.1 → 1.6.1

package/dist/web/routes/session-routes.js

@@ -12,7 +12,8 @@ import { randomBytes } from 'node:crypto';
 import { ApiErrorCode, createErrorResponse, getErrorMessage, } from '../../types.js';
 import { Session, isAltScreenStripMode } from '../../session.js';
 import { SseEvent } from '../sse-events.js';
-import { CreateSessionSchema, SessionNameSchema, SessionColorSchema, RunPromptSchema, SessionInputWithLimitSchema, ResizeSchema, AutoClearSchema, AutoCompactSchema, AutoResumeSchema, ImageWatcherSchema, FlickerFilterSchema, QuickRunSchema, QuickStartSchema, InteractiveStartSchema, } from '../schemas.js';
+import { CreateSessionSchema, SessionNameSchema, SessionColorSchema, RunPromptSchema, SessionInputWithLimitSchema, ResizeSchema, AutoClearSchema, AutoCompactSchema, AutoResumeSchema, PinSessionSchema, ImageWatcherSchema, FlickerFilterSchema, QuickRunSchema, QuickStartSchema, InteractiveStartSchema, SessionOrderUpdateSchema, } from '../schemas.js';
+import { mergeSessionOrder } from '../../session-order.js';
 import { autoConfigureRalph, canAccessOwned, CASES_DIR, findSessionOrFail, getAuthUser, isAdmin, isWorkingDirAllowed, ownerFor, parseBody, persistAndBroadcastSession, resolveCasesDir, sessionCapacityMessage, SETTINGS_PATH, validatePathWithinBase, } from '../route-helpers.js';
 import { canUsernameRunPrivilegedCommands, resolveClaudeModeForUsername } from '../../user-store.js';
 import { isMultiUserMode } from '../../config/multiuser.js';
@@ -27,7 +28,7 @@ import { RunSummaryTracker } from '../../run-summary.js';
 import { MAX_INPUT_LENGTH, MAX_SESSION_NAME_LENGTH } from '../../config/terminal-limits.js';
 import { MAX_PASTE_IMAGE_BYTES } from '../../config/buffer-limits.js';
 import { dataPath, getDataDir } from '../../config/instance.js';
-import { checkRemoteTmuxAvailable, readRemoteCases, readRemoteHosts, toSessionRemote } from '../../remote-hosts.js';
+import { checkRemoteTmuxAvailable, readRemoteCases, readRemoteHosts, toAttachedSessionRemote, toSessionRemote, } from '../../remote-hosts.js';
 import { checkDockerAvailable, checkDockerConfigDrift, checkDockerTmuxAvailable, ensureAgentBaseImage, DEFAULT_AGENT_IMAGE, persistDockerCaseClaudeSessionId, readDockerCases, readDockerHosts, toSessionDocker, } from '../../docker-hosts.js';
 import { LRUMap } from '../../utils/lru-map.js';
 // Path to linked-cases registry (same file used by case-routes resolveCasePath)
@@ -244,6 +245,16 @@ export function registerSessionRoutes(app, ctx) {
             return list;
         return list.filter((s) => canAccessOwned(user, s.owner));
     });
+    // ========== Session Tab Order (global sync, COD-131) ==========
+    app.put('/api/session-order', async (req) => {
+        const { order } = parseBody(SessionOrderUpdateSchema, req.body, 'Invalid session order');
+        // Server is authoritative but never drops ids it knows about that the
+        // pushing device hadn't loaded yet — those fall to the end (mergeSessionOrder).
+        const merged = mergeSessionOrder(order, ctx.store.getSessionOrder());
+        ctx.store.setSessionOrder(merged);
+        ctx.broadcast(SseEvent.SessionOrderChanged, { order: merged });
+        return { success: true, data: { order: merged } };
+    });
     // ========== Session Creation ==========
     app.post('/api/sessions', async (req) => {
         const owner = ownerFor(req);
@@ -252,7 +263,21 @@ export function registerSessionRoutes(app, ctx) {
         if (capMsg)
             return createErrorResponse(ApiErrorCode.OPERATION_FAILED, capMsg);
         const body = parseBody(CreateSessionSchema, req.body);
-        const workingDir = body.workingDir || process.cwd();
+        let workingDir = body.workingDir || process.cwd();
+        let remote = undefined;
+        // COD-105 — attach to a discovered (non-owned) remote tmux session. The
+        // remote session is already running, so we skip the tmux-prereq probe and
+        // build a NON-owned SessionRemote (detach-not-kill on close). Remote CASE
+        // creation (owned durable sessions) is handled by the dedicated case-create
+        // endpoint below, which #145 consolidated remote-host resolution into.
+        if (body.attachRemoteSession) {
+            const { hostId, remoteSessionName } = body.attachRemoteSession;
+            const host = (await readRemoteHosts(CODEMAN_CONFIG_DIR)).find((item) => item.id === hostId);
+            if (!host)
+                return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Remote host not found');
+            workingDir = `${host.username}@${host.host}:${remoteSessionName}`;
+            remote = toAttachedSessionRemote(host, remoteSessionName, workingDir);
+        }
         // Multi-user: shell mode is arbitrary command execution as the host account,
         // gated behind the same grant as bypass (section 6.3). Resolve the owner's grant
         // from the store so a GRANTED regular user is not wrongly denied (AuthUser role alone can't tell).
@@ -407,6 +432,7 @@ export function registerSessionRoutes(app, ctx) {
             envOverrides: body.envOverrides,
             effort: body.effort,
             tmuxHistoryLimit: terminalHistoryConfig.tmuxHistoryLimit,
+            remote,
             owner,
         });
         ctx.addSession(session);
@@ -1403,6 +1429,45 @@ export function registerSessionRoutes(app, ctx) {
             },
         };
     });
+    // ========== Pin (float to top of the session manager list, COD-139) ==========
+    app.post('/api/sessions/:id/pin', async (req) => {
+        const { id } = req.params;
+        const body = parseBody(PinSessionSchema, req.body, 'Invalid request body');
+        const session = ctx.sessions.get(id);
+        if (session) {
+            if (!canAccessOwned(getAuthUser(req), session.owner)) {
+                return createErrorResponse(ApiErrorCode.NOT_FOUND, `Session ${id} not found`);
+            }
+            session.setPinned(body.pinned);
+            // Persist + broadcast session:updated (keeps tabs/state consistent), then a
+            // dedicated session:pinned event so the session manager list re-sorts live.
+            persistAndBroadcastSession(ctx, session);
+            ctx.broadcast(SseEvent.SessionPinned, {
+                id,
+                pinned: session.pinned,
+                pinnedAt: session.pinnedAt ?? undefined,
+            });
+            return {
+                success: true,
+                data: {
+                    pinned: session.pinned,
+                    pinnedAt: session.pinnedAt ?? undefined,
+                },
+            };
+        }
+        // COD-142 keeps a pinned session's record after kill (demoteOrRemoveSession),
+        // so pin toggles must also work WITHOUT a live Session — otherwise a
+        // pinned-then-killed record could never be unpinned (cleanup skips pinned
+        // records, and the record has no live session to route through).
+        const persisted = ctx.store.getSession(id);
+        if (!persisted || !canAccessOwned(getAuthUser(req), persisted.owner)) {
+            return createErrorResponse(ApiErrorCode.NOT_FOUND, `Session ${id} not found`);
+        }
+        const pinnedAt = body.pinned ? Date.now() : undefined;
+        ctx.store.setSession(id, { ...persisted, pinned: body.pinned || undefined, pinnedAt });
+        ctx.broadcast(SseEvent.SessionPinned, { id, pinned: body.pinned, pinnedAt });
+        return { success: true, data: { pinned: body.pinned, pinnedAt } };
+    });
     // ========== Image Watcher ==========
     app.post('/api/sessions/:id/image-watcher', async (req) => {
         const { id } = req.params;
@@ -1919,6 +1984,63 @@ export function registerSessionRoutes(app, ctx) {
         }
         return undefined;
     }
+    /**
+     * Extract the text of the LAST user message from a JSONL transcript chunk
+     * (COD-145). Mirrors `extractFirstUserPrompt` exactly — same user-message
+     * detection, same noise/secret/slash-command filters, same 120-char cap — but
+     * keeps the last qualifying match instead of returning on the first. Scan the
+     * file tail for this (the most recent prompt lives near the end).
+     */
+    function extractLastUserPrompt(text) {
+        const MAX_PROMPT_LEN = 120;
+        let result;
+        let start = 0;
+        while (start < text.length) {
+            const end = text.indexOf('\n', start);
+            const line = end === -1 ? text.slice(start) : text.slice(start, end);
+            start = end === -1 ? text.length : end + 1;
+            if (!line.includes('"type":"user"'))
+                continue;
+            try {
+                const entry = JSON.parse(line);
+                if (entry.type !== 'user' || !entry.message)
+                    continue;
+                const content = entry.message.content;
+                let msgText;
+                if (typeof content === 'string') {
+                    msgText = content;
+                }
+                else if (Array.isArray(content)) {
+                    const textBlock = content.find((b) => b.type === 'text');
+                    if (textBlock)
+                        msgText = textBlock.text;
+                }
+                if (!msgText)
+                    continue;
+                msgText = msgText
+                    .replace(/<[^>]+>/g, '')
+                    .replace(new RegExp(String.raw `\x1b\[[0-9;]*[a-zA-Z]`, 'g'), '')
+                    .trim()
+                    .replace(/\s+/g, ' ');
+                if (!msgText)
+                    continue;
+                if (/^(Caveat:|init\b|clear\b|resume\b|\/[a-z][\w-]*\b|You are a |\[Request |Set model to )/i.test(msgText) ||
+                    /^(Please )?(analyze|review) this codebase/i.test(msgText) ||
+                    /^(Read|Implement the following) .+, then (search|list|check) /i.test(msgText) ||
+                    /^\d+ vulnerabilit/i.test(msgText) ||
+                    /\btoolu_/.test(msgText) ||
+                    /^[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+/.test(msgText) ||
+                    /\b(sk-ant-|ANTHROPIC_API_KEY|API_KEY=|SECRET|TOKEN=)/i.test(msgText) ||
+                    msgText.length < 8)
+                    continue;
+                result = msgText.length > MAX_PROMPT_LEN ? msgText.slice(0, MAX_PROMPT_LEN) + '…' : msgText;
+            }
+            catch {
+                // Malformed line — skip
+            }
+        }
+        return result;
+    }
     /**
      * Decode a Claude project key (e.g. "-Users-teigen-Documents-Workspace-AI-project-Mirror")
      * back to a filesystem path ("/Users/teigen/Documents/Workspace/AI_project/Mirror").
@@ -2096,6 +2218,15 @@ export function registerSessionRoutes(app, ctx) {
                 if (tail)
                     firstPrompt = extractFirstUserPrompt(tail);
             }
+            // COD-145: last (most recent) user prompt lives near the END of the file, so
+            // prefer the tail. For large files where no tail was read yet, read one
+            // (mirrors the firstPrompt > 65536 block). Small files fit in `head`, which
+            // then contains the whole transcript — scan it for the last match instead.
+            if (!tail && fileStat.size > 65536) {
+                const tailBuf = Buffer.alloc(32768);
+                tail = await readFileTail(filePath, tailBuf, fileStat.size);
+            }
+            const lastPrompt = (tail ? extractLastUserPrompt(tail) : undefined) ?? (head ? extractLastUserPrompt(head) : undefined);
             out.push({
                 sessionId,
                 workingDir,
@@ -2103,6 +2234,7 @@ export function registerSessionRoutes(app, ctx) {
                 sizeBytes: fileStat.size,
                 lastModified: fileStat.mtime.toISOString(),
                 firstPrompt,
+                lastPrompt,
             });
         }
         return out;
@@ -2174,6 +2306,8 @@ export function registerSessionRoutes(app, ctx) {
                 createdAt: st.createdAt,
                 lastActivityAt: st.lastActivityAt,
                 claudeSessionId: s.claudeSessionId ?? undefined,
+                pinned: st.pinned,
+                pinnedAt: st.pinnedAt,
             };
         });
         // Persisted sessions (state.json). resumeSessionId is the Claude
@@ -2188,6 +2322,8 @@ export function registerSessionRoutes(app, ctx) {
             createdAt: p.createdAt,
             lastActivityAt: p.lastActivityAt,
             claudeSessionId: p.resumeSessionId,
+            pinned: p.pinned,
+            pinnedAt: p.pinnedAt,
         }));
         // Lifecycle audit log (newest-first, capped).
         let lifecycle = [];
@@ -2220,6 +2356,7 @@ export function registerSessionRoutes(app, ctx) {
                         sizeBytes: h.sizeBytes,
                         lastModified: h.lastModified,
                         firstPrompt: h.firstPrompt,
+                        lastPrompt: h.lastPrompt,
                         projectKey: h.projectKey,
                     });
                 }