claude-bridge-cli 2.0.3 → 2.0.6

package/lib/bridge.js

@@ -64,6 +64,92 @@ function saveImages(images, sessionId) {
   return saved;
 }
 
+// ── Per-session file exchange (the Files drawer) ──────────────────────────
+// Same per-session folder used for images doubles as a two-way file drawer:
+// the user uploads ANY file here (Claude reads it), and Claude drops files here
+// (the user downloads them). Old files pruned on access.
+const MAX_FILE_BYTES = 45 * 1024 * 1024;
+const FILE_PRUNE_DAYS = 14;
+const FILE_NAME_RE = /^[A-Za-z0-9._ ()+\-]+$/;
+const EXT_MIME = {
+  drawio: "application/xml", pdf: "application/pdf", json: "application/json",
+  csv: "text/csv", txt: "text/plain", md: "text/markdown", xml: "application/xml",
+  svg: "image/svg+xml", png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg",
+  gif: "image/gif", webp: "image/webp", zip: "application/zip", gz: "application/gzip",
+  tar: "application/x-tar", html: "text/html", css: "text/css", js: "text/javascript",
+  ts: "text/plain", py: "text/x-python", cs: "text/plain", java: "text/x-java",
+  yml: "text/yaml", yaml: "text/yaml", sql: "text/plain", log: "text/plain", sh: "text/x-sh",
+};
+function mimeFor(name) {
+  const e = path.extname(name || "").slice(1).toLowerCase();
+  return EXT_MIME[e] || "application/octet-stream";
+}
+function sanitizeAnyFilename(name) {
+  let base = path.basename((name || "").trim())
+    .replace(/[^A-Za-z0-9._ ()+\-]/g, "_")
+    .replace(/^[._ ]+|[._ ]+$/g, "");
+  return (base || "upload.bin").slice(0, 200);
+}
+function sessionFilesDir(sid) {
+  if (!/^[A-Za-z0-9._-]+$/.test(sid || "")) throw new Error("bad session id");
+  return path.join(dataDir(), "images", sid);
+}
+function pruneSessionFiles(dir) {
+  const cutoff = Date.now() - FILE_PRUNE_DAYS * 86400 * 1000;
+  let entries; try { entries = fs.readdirSync(dir); } catch { return; }
+  for (const f of entries) {
+    const fp = path.join(dir, f);
+    try { const st = fs.statSync(fp); if (st.isFile() && st.mtimeMs < cutoff) fs.unlinkSync(fp); } catch {}
+  }
+}
+function listSessionFiles(sid) {
+  const dir = sessionFilesDir(sid);
+  pruneSessionFiles(dir);
+  let entries; try { entries = fs.readdirSync(dir); } catch { return []; }
+  const out = [];
+  for (const f of entries.sort()) {
+    const fp = path.join(dir, f);
+    try {
+      const st = fs.statSync(fp);
+      if (st.isFile()) out.push({ name: f, size: st.size, mtime: Math.floor(st.mtimeMs / 1000), mime: mimeFor(f) });
+    } catch {}
+  }
+  return out;
+}
+function readSessionFile(sid, name) {
+  const dir = sessionFilesDir(sid);
+  const safe = path.basename(name || "");
+  if (!safe || safe !== name || !FILE_NAME_RE.test(safe)) throw new Error("bad file name");
+  const fp = path.join(dir, safe);
+  if (!fs.existsSync(fp) || !fs.statSync(fp).isFile()) { const e = new Error("file not found"); e.notFound = true; throw e; }
+  if (fs.statSync(fp).size > MAX_FILE_BYTES) throw new Error("file exceeds limit — too large to transfer");
+  const buf = fs.readFileSync(fp);
+  return { name: safe, size: buf.length, mime: mimeFor(safe), data_base64: buf.toString("base64") };
+}
+function saveSessionFile(sid, name, dataB64) {
+  const dir = sessionFilesDir(sid);
+  fs.mkdirSync(dir, { recursive: true });
+  pruneSessionFiles(dir);
+  if (typeof dataB64 !== "string") throw new Error("missing data_base64");
+  const mm = dataB64.match(/^data:[^;]+;base64,([\s\S]+)$/);
+  if (mm) dataB64 = mm[1];
+  const buf = Buffer.from(dataB64, "base64");
+  if (buf.length > MAX_FILE_BYTES) throw new Error("file too large");
+  const final = `${Date.now()}-${sanitizeAnyFilename(name || "upload.bin")}`;
+  const fp = path.join(dir, final);
+  fs.writeFileSync(fp, buf, { mode: 0o600 });
+  return { name: final, size: buf.length, mime: mimeFor(final), path: fp };
+}
+function deleteSessionFile(sid, name) {
+  const dir = sessionFilesDir(sid);
+  const safe = path.basename(name || "");
+  if (!safe || safe !== name || !FILE_NAME_RE.test(safe)) throw new Error("bad file name");
+  const fp = path.join(dir, safe);
+  if (!fs.existsSync(fp) || !fs.statSync(fp).isFile()) { const e = new Error("file not found"); e.notFound = true; throw e; }
+  fs.unlinkSync(fp);
+  return { deleted: safe };
+}
+
 function splitUserTextAndImages(text) {
   const m = text.match(/\nThe user attached \d+ image\(s\) at these absolute paths\. Use the Read tool to view them:\n([\s\S]+)$/);
   if (!m) return { cleanText: text, imagePaths: [] };
@@ -466,18 +552,20 @@ function askClaude(config, { prompt, session_id, images, cwd, plan_mode, allow_t
     const isWin = process.platform === "win32";
     const isCmdShim = isWin && config.claudeBin.endsWith(".cmd");
 
-    // Fall back to @file syntax in two cases:
+    // Pass the prompt via a temp file (@file, read by claude itself) instead of as
+    // a command-line argument when:
     //  1) Prompt exceeds Windows cmd.exe's ~8K arg limit (threshold 6000).
-    //  2) Prompt contains a newline AND we're on Windows with a .cmd shim
-    //     — cmd.exe parses arg strings line-by-line and silently truncates
-    //     at the first \n, even with Node.js's proper argv quoting. Without
-    //     this fallback, any multi-line prompt to Claude on Windows lost
-    //     everything after line 1, and the model saw a stub message + the
-    //     header but none of the body. Manifested as "your message got
-    //     cut off" responses for prompts that LOOK short.
+    //  2) We're on Windows with a .cmd shim — period. The shim runs through
+    //     `cmd.exe /c`, which RE-PARSES the prompt with CMD's own rules: a double
+    //     quote (") or a metacharacter (% & | < > ^) breaks the command line and
+    //     surfaces as the cryptic "The system cannot find the file specified";
+    //     a newline silently truncates the prompt at line 1. Node's argv quoting
+    //     can't protect against cmd.exe's second parse. Passing @file sidesteps ALL
+    //     of it, so do it for EVERY cmd-shim prompt — not just multi-line ones.
+    //     (Previously only triggered on \r|\n, so quoted single-line prompts failed.)
     const useTempFile =
       finalPrompt.length > 6000 ||
-      (isWin && isCmdShim && /\r|\n/.test(finalPrompt));
+      (isWin && isCmdShim);
     let tmpFile = null;
     if (useTempFile) {
       tmpFile = path.join(os.tmpdir(), `claude-prompt-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`);
@@ -767,6 +855,33 @@ function startBridge(config) {
       }
     }
 
+    // Session files — list (GET) / upload (POST)
+    m = url.pathname.match(/^\/sessions\/([A-Za-z0-9._-]+)\/files$/);
+    if (m) {
+      if (req.method === "GET") {
+        try { send(200, { files: listSessionFiles(m[1]) }); } catch (e) { send(400, { error: String(e.message || e) }); }
+        return;
+      }
+      if (req.method === "POST") {
+        const body = await readBody(req);
+        try { send(200, saveSessionFile(m[1], body.name, body.data_base64 || body.data)); }
+        catch (e) { send(400, { error: String(e.message || e) }); }
+        return;
+      }
+    }
+    // Session files — download one (GET) / remove one (DELETE)
+    m = url.pathname.match(/^\/sessions\/([A-Za-z0-9._-]+)\/files\/(.+)$/);
+    if (m && req.method === "GET") {
+      try { send(200, readSessionFile(m[1], decodeURIComponent(m[2]))); }
+      catch (e) { send(e.notFound ? 404 : 400, { error: String(e.message || e) }); }
+      return;
+    }
+    if (m && req.method === "DELETE") {
+      try { send(200, deleteSessionFile(m[1], decodeURIComponent(m[2]))); }
+      catch (e) { send(e.notFound ? 404 : 400, { error: String(e.message || e) }); }
+      return;
+    }
+
     send(404, { error: "not found" });
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-bridge-cli",
-  "version": "2.0.3",
+  "version": "2.0.6",
   "description": "Use Claude Code from your browser. Runs a local server that connects your browser tools to the Claude CLI.",
   "main": "lib/bridge.js",
   "bin": {
@@ -23,4 +23,4 @@
   "engines": {
     "node": ">=18.0.0"
   }
-}
+}