claude-code-kanban 4.26.0 → 4.27.0

package/lib/inline-assets.js

@@ -235,4 +235,4 @@ async function inlineHtmlAssets(html, absHtmlPath) {
   return { html: out, bytes: ctx.spent, skipped: ctx.skipped };
 }
 
-module.exports = { inlineHtmlAssets, MAX_ASSET_BYTES };
+module.exports = { inlineHtmlAssets, MIME_BY_EXT, MAX_ASSET_BYTES };

package/lib/parsers.js

@@ -185,6 +185,14 @@ function pushUserMessage(messages, text, timestamp, sysLabel, extras) {
     label = base + formatTaskUsage(notif.usage);
     safeText = notif.result || base;
   }
+  // A subagent, teammate or peer session handing work back through SendMessage is
+  // also model output, not user input. Callers on the `origin` path pass the parts
+  // ready-made; the text paths (type:'user', queued enqueue) parse the envelope.
+  const agentMsg = extras?.agent || (notif ? null : parseAgentMessage(safeText));
+  if (agentMsg) {
+    label = agentMsg.label;
+    safeText = agentMsg.body;
+  }
   const truncated = safeText.length > USER_TEXT_MAX;
   const msg = {
     type: 'user',
@@ -200,12 +208,26 @@ function pushUserMessage(messages, text, timestamp, sysLabel, extras) {
     if (notif.taskId) msg.taskId = notif.taskId;
     if (notif.status) msg.taskStatus = notif.status;
   }
+  if (agentMsg) {
+    msg.agentMessage = true;
+    if (agentMsg.from) msg.agentFrom = agentMsg.from;
+  }
   if (extras) {
     if (extras.uuid) msg.uuid = extras.uuid;
     if (extras.images && extras.images.length) msg.images = extras.images;
     if (extras.toolResultRefs && extras.toolResultRefs.length) msg.toolResultRefs = extras.toolResultRefs;
     if (extras.queued) msg.queued = true;
   }
+  // One agent message reaches the log twice: the queued enqueue record and the
+  // delivered one right after it. Keep the first and drop the twin here, so no
+  // renderer has to know about the double write.
+  if (agentMsg) {
+    const prev = messages[messages.length - 1];
+    if (prev?.agentMessage && (prev.agentFrom || null) === (msg.agentFrom || null) && prev.text === msg.text) {
+      if (!msg.queued) delete prev.queued;
+      return;
+    }
+  }
   messages.push(msg);
 }
 
@@ -587,6 +609,43 @@ function parseTaskNotification(text) {
   };
 }
 
+// A message another agent sent into this session (a subagent hand-back, a teammate
+// or a peer session using SendMessage) is model output, not user input. Turn the
+// sender and the raw body into the chip label plus the body alone, so it never
+// renders under a person icon.
+function agentMessageParts(from, rawBody, handback) {
+  let body = (rawBody || '').trimEnd();
+  // A hand-back frames the report with the harness note that it carries no user
+  // authority, and indents every line of the report by two spaces so a forged
+  // frame at column zero is impossible. Strip the frame and that indent.
+  const framed = body.match(/^\[Subagent hand-back\][\s\S]*?report follows:\n([\s\S]*)$/);
+  if (framed) body = framed[1].replace(/^ {2}/gm, '').trim();
+  const handBack = !!framed || !!handback;
+  const kind = handBack ? 'Subagent hand-back' : 'Agent message';
+  // Harness agent ids are long hex; a named sender ("code-review") is shown whole.
+  const short = from && /^[0-9a-f]{12,}$/i.test(from) ? from.slice(0, 8) : from;
+  return { from: from || null, handBack, label: short ? `${kind} · ${short}` : kind, body };
+}
+
+// The text delivery paths carry the body inside an <agent-message from="..."> envelope,
+// with the harness notes outside it. The envelope must open the message (after the
+// harness preamble, if any): prose that merely quotes the tag is a user message.
+// The body is unescaped agent text that can quote the envelope it describes, so the
+// real closing tag is the last one.
+function parseAgentMessage(text) {
+  if (typeof text !== 'string' || !text.includes('<agent-message')) return null;
+  const start = text.indexOf('<agent-message');
+  const preamble = text.slice(0, start).trim();
+  if (preamble && !/^Another Claude session sent a message[^\n]*:$/.test(preamble)) return null;
+  const gt = text.indexOf('>', start);
+  const end = text.lastIndexOf('</agent-message>');
+  if (gt === -1 || end < gt) return null;
+  const from = (text.slice(start, gt).match(/from="([^"]*)"/) || [])[1] || null;
+  let bodyStart = gt + 1;
+  while (text[bodyStart] === '\n') bodyStart++;
+  return agentMessageParts(from, text.slice(bodyStart, end));
+}
+
 function getSystemMessageLabel(text) {
   const taskMatch = text.match(/<summary>([^<]+)<\/summary>/);
   if (taskMatch) return taskMatch[1].trim();
@@ -801,6 +860,15 @@ function readRecentMessages(jsonlPath, limit = 10) {
                 messages.push(msg);
               }
             }
+          } else if (obj.type === 'user' && obj.origin?.kind === 'peer') {
+            // Claude Code >= 2.1 files the delivered copy as isMeta (dropped by the
+            // branch below) and repeats the envelope's fields on `origin`. That
+            // record is always written; the queued enqueue is not, so read it from
+            // here and let pushUserMessage drop whichever twin arrives second.
+            pushUserMessage(messages, '', obj.timestamp, null, {
+              uuid: obj.uuid,
+              agent: agentMessageParts(obj.origin.from, obj.origin.body, obj.origin.handback)
+            });
           } else if (obj.type === 'user' && obj.message?.role === 'user' && !obj.isMeta) {
             if (obj.isCompactSummary) {
               // Surface the compaction summary as a single expandable "Compacted"
@@ -1359,6 +1427,49 @@ function readArtifactLinks(jsonlPath) {
   return [...byUrl.values()].sort((x, y) => (x.firstSeen < y.firstSeen ? -1 : x.firstSeen > y.firstSeen ? 1 : 0));
 }
 
+const SCRATCH_NEW_RE = /\bscratch new\b/;
+// `scratch new` reports where it put the pad; the two spaces are the CLI's own column
+// padding, which is what makes the prefilter below narrow enough to be worth having.
+const SCRATCH_MANIFEST_RE = /^\s*manifest\s*:\s*(.+?)\s*$/m;
+// The name must sit immediately after `new`, and the bare-word branch must refuse a
+// leading `-`, so that a flag or a flag's value cannot be read as the name.
+const SCRATCH_NAME_RE = /\bscratch\s+new\s+(?:"([^"]+)"|'([^']+)'|(?!-)(\S+))/;
+
+// The `scratch new` calls in a transcript, `{ ts, path, name }` per call. `path` is null
+// whenever the command piped the CLI's output away — the common case, not an edge one:
+// the manifest is the 4th of ~13 printed lines, so any `| tail -N` cuts it off. `name`
+// stands in because it is what the manifest stores as its own `name`; the path is not
+// recovered from the command, which would mean tracking the `cd` and a relative `--dir`.
+function readScratchpadCreations(jsonlPath) {
+  const calls = new Map();
+  try {
+    const content = readFileSync(jsonlPath, 'utf8');
+    for (const line of content.split('\n')) {
+      // Substring reject before JSON.parse: transcripts reach tens of megabytes and
+      // only a handful of lines can ever match.
+      const isCall = line.includes('scratch new');
+      if (!isCall && !line.includes('manifest  :')) continue;
+      let obj;
+      try { obj = JSON.parse(line); } catch (_) { continue; }
+      const blocks = obj?.message?.content;
+      if (!Array.isArray(blocks)) continue;
+      const ts = Date.parse(obj.timestamp);
+      for (const b of blocks) {
+        if (b?.type === 'tool_use' && b.name === 'Bash' && SCRATCH_NEW_RE.test(b.input?.command || '')) {
+          if (b.id && Number.isFinite(ts)) {
+            const named = SCRATCH_NAME_RE.exec(b.input.command);
+            calls.set(b.id, { ts, path: null, name: named?.slice(1).find(Boolean) ?? null });
+          }
+        } else if (b?.type === 'tool_result' && calls.has(b.tool_use_id)) {
+          const m = SCRATCH_MANIFEST_RE.exec(toolResultText(b.content));
+          if (m) calls.get(b.tool_use_id).path = m[1];
+        }
+      }
+    }
+  } catch (_) {}
+  return [...calls.values()];
+}
+
 function readCompactSummaries(jsonlPath) {
   const results = [];
   // Inline format: newer Claude Code stores the summary directly in the parent
@@ -1684,6 +1795,7 @@ module.exports = {
   parseSessionsIndex,
   parseJsonlLine,
   parseTaskNotification,
+  parseAgentMessage,
   getSystemMessageLabel,
   readSessionInfoFromJsonl,
   readRecentMessages,
@@ -1698,6 +1810,7 @@ module.exports = {
   buildSessionDigest,
   readCompactSummaries,
   readArtifactLinks,
+  readScratchpadCreations,
   findTerminatedTeammates,
   extractPromptFromTranscript,
   extractModelFromTranscript,

package/lib/scratch-files.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const fs = require('node:fs').promises;
+const path = require('node:path');
+const { isContained } = require('./contain');
+
+// Resolves a folder inside a session's scratchpad dir from the path the client sends
+// back — the absolute path a listing handed out, or one relative to the root. Returns
+// null when it escapes the root (`..`, another dir, a symlink out), so the endpoint
+// never lists anything the root did not hand out.
+function resolveScratchSubdir(root, sub) {
+  if (!sub) return root;
+  if (typeof sub !== 'string') return null;
+  const full = path.resolve(root, sub);
+  return isContained(full, root) ? full : null;
+}
+
+// One level of a scratchpad dir, newest first whatever the kind. Not recursive on
+// purpose: sessions drop clones and build output in here, and the client asks for a
+// folder's children only when the user opens it.
+async function listScratchDir(dir) {
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch (_) {
+    return [];
+  }
+  const rows = await Promise.all(
+    entries
+      .filter((entry) => entry.isFile() || entry.isDirectory())
+      .map(async (entry) => {
+        const full = path.join(dir, entry.name);
+        try {
+          const { mtimeMs } = await fs.stat(full);
+          return { name: entry.name, path: full, kind: entry.isDirectory() ? 'dir' : 'file', mtimeMs };
+        } catch (_) {
+          return null;
+        }
+      }),
+  );
+  return rows
+    .filter(Boolean)
+    .sort((a, b) => b.mtimeMs - a.mtimeMs)
+    .map(({ mtimeMs, ...row }) => ({ ...row, modifiedAt: new Date(mtimeMs).toISOString() }));
+}
+
+module.exports = { resolveScratchSubdir, listScratchDir };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-kanban",
-  "version": "4.26.0",
+  "version": "4.27.0",
   "description": "A web-based Kanban board for viewing Claude Code tasks with agent teams support",
   "main": "server.js",
   "bin": {