claude-code-workflow 6.3.48 → 6.3.49

package/ccw/src/core/routes/system-routes.ts

@@ -6,6 +6,7 @@ import type { Server } from 'http';
 import { readFileSync, existsSync, promises as fsPromises } from 'fs';
 import { join } from 'path';
 import { resolvePath, getRecentPaths, trackRecentPath, removeRecentPath, normalizePathForDisplay } from '../../utils/path-resolver.js';
+import { validatePath as validateAllowedPath } from '../../utils/path-validator.js';
 import { scanSessions } from '../session-scanner.js';
 import { aggregateData } from '../data-aggregator.js';
 import {
@@ -276,26 +277,47 @@ export async function handleSystemRoutes(ctx: SystemRouteContext): Promise<boole
     return true;
   }
 
-  // API: Read a JSON file (for fix progress tracking)
-  if (pathname === '/api/file') {
-    const filePath = url.searchParams.get('path');
-    if (!filePath) {
-      res.writeHead(400, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'File path is required' }));
-      return true;
-    }
-
-    try {
-      const content = await fsPromises.readFile(filePath, 'utf-8');
-      const json = JSON.parse(content);
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(json));
-    } catch (err) {
-      res.writeHead(404, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'File not found or invalid JSON' }));
-    }
-    return true;
-  }
+  // API: Read a JSON file (for fix progress tracking)
+  if (pathname === '/api/file') {
+    const filePath = url.searchParams.get('path');
+    if (!filePath) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'File path is required' }));
+      return true;
+    }
+
+    let validatedPath: string;
+    try {
+      // Validate path is within allowed directories (fix: sec-001-a1b2c3d4)
+      validatedPath = await validateAllowedPath(filePath, { mustExist: true, allowedDirectories: [initialPath] });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const status = message.includes('Access denied') ? 403 : (message.includes('File not found') ? 404 : 400);
+      console.error(`[System] Path validation failed: ${message}`);
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        error: status === 403 ? 'Access denied' : (status === 404 ? 'File not found' : 'Invalid path')
+      }));
+      return true;
+    }
+
+    try {
+      const content = await fsPromises.readFile(validatedPath, 'utf-8');
+      const json = JSON.parse(content);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(json));
+    } catch (err: unknown) {
+      const errno = typeof err === 'object' && err !== null && 'code' in err ? String((err as any).code) : null;
+      const status = err instanceof SyntaxError ? 400 : (errno === 'EACCES' ? 403 : 404);
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[System] Failed to read JSON file: ${message}`);
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        error: status === 403 ? 'Access denied' : (status === 400 ? 'Invalid JSON' : 'File not found')
+      }));
+    }
+    return true;
+  }
 
   // API: System notify - CLI to Server communication bridge
   // Allows CLI commands to trigger WebSocket broadcasts for UI updates
@@ -437,10 +459,23 @@ export async function handleSystemRoutes(ctx: SystemRouteContext): Promise<boole
         targetPath = path.join(os.homedir(), targetPath.slice(1));
       }
 
-      // Resolve to absolute path
-      if (!path.isAbsolute(targetPath)) {
-        targetPath = path.resolve(targetPath);
-      }
+      // Resolve to absolute path
+      if (!path.isAbsolute(targetPath)) {
+        targetPath = path.resolve(targetPath);
+      }
+
+      // Validate path is within allowed directories (fix: sec-003-c3d4e5f6)
+      try {
+        targetPath = await validateAllowedPath(targetPath, {
+          mustExist: true,
+          allowedDirectories: [initialPath, os.homedir()]
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = message.includes('Access denied') ? 403 : 400;
+        console.error(`[System] Path validation failed: ${message}`);
+        return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+      }
 
       try {
         const stat = await fs.promises.stat(targetPath);
@@ -464,18 +499,20 @@ export async function handleSystemRoutes(ctx: SystemRouteContext): Promise<boole
             return a.name.localeCompare(b.name);
           });
 
-        return {
-          currentPath: targetPath,
-          parentPath: path.dirname(targetPath),
-          items,
-          homePath: os.homedir()
-        };
-      } catch (err) {
-        return { error: 'Cannot access directory: ' + (err as Error).message, status: 400 };
-      }
-    });
-    return true;
-  }
+        return {
+          currentPath: targetPath,
+          parentPath: path.dirname(targetPath),
+          items,
+          homePath: os.homedir()
+        };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`[System] Failed to browse directory: ${message}`);
+        return { error: 'Cannot access directory', status: 400 };
+      }
+    });
+    return true;
+  }
 
   // API: File dialog - select file (validate path exists)
   if (pathname === '/api/dialog/open-file' && req.method === 'POST') {
@@ -497,10 +534,23 @@ export async function handleSystemRoutes(ctx: SystemRouteContext): Promise<boole
         targetPath = path.join(os.homedir(), targetPath.slice(1));
       }
 
-      // Resolve to absolute path
-      if (!path.isAbsolute(targetPath)) {
-        targetPath = path.resolve(targetPath);
-      }
+      // Resolve to absolute path
+      if (!path.isAbsolute(targetPath)) {
+        targetPath = path.resolve(targetPath);
+      }
+
+      // Validate path is within allowed directories (fix: sec-003-c3d4e5f6)
+      try {
+        targetPath = await validateAllowedPath(targetPath, {
+          mustExist: true,
+          allowedDirectories: [initialPath, os.homedir()]
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const status = message.includes('Access denied') ? 403 : 400;
+        console.error(`[System] Path validation failed: ${message}`);
+        return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+      }
 
       try {
         await fs.promises.access(targetPath, fs.constants.R_OK);
@@ -508,16 +558,18 @@ export async function handleSystemRoutes(ctx: SystemRouteContext): Promise<boole
 
         return {
           success: true,
-          path: targetPath,
-          isFile: stat.isFile(),
-          isDirectory: stat.isDirectory()
-        };
-      } catch {
-        return { error: 'File not accessible', status: 404 };
-      }
-    });
-    return true;
-  }
+          path: targetPath,
+          isFile: stat.isFile(),
+          isDirectory: stat.isDirectory()
+        };
+      } catch (err: unknown) {
+        const errno = typeof err === 'object' && err !== null && 'code' in err ? String((err as any).code) : null;
+        const status = errno === 'EACCES' ? 403 : 404;
+        return { error: status === 403 ? 'Access denied' : 'File not accessible', status };
+      }
+    });
+    return true;
+  }
 
   return false;
 }

package/ccw/src/core/server.ts

@@ -8,6 +8,7 @@ import { resolvePath, getRecentPaths, normalizePathForDisplay } from '../utils/p
 import { handleStatusRoutes } from './routes/status-routes.js';
 import { handleCliRoutes, cleanupStaleExecutions } from './routes/cli-routes.js';
 import { handleCliSettingsRoutes } from './routes/cli-settings-routes.js';
+import { handleProviderRoutes } from './routes/provider-routes.js';
 import { handleMemoryRoutes } from './routes/memory-routes.js';
 import { handleCoreMemoryRoutes } from './routes/core-memory-routes.js';
 import { handleMcpRoutes } from './routes/mcp-routes.js';
@@ -17,6 +18,7 @@ import { handleGraphRoutes } from './routes/graph-routes.js';
 import { handleSystemRoutes } from './routes/system-routes.js';
 import { handleFilesRoutes } from './routes/files-routes.js';
 import { handleSkillsRoutes } from './routes/skills-routes.js';
+import { handleCommandsRoutes } from './routes/commands-routes.js';
 import { handleIssueRoutes } from './routes/issue-routes.js';
 import { handleDiscoveryRoutes } from './routes/discovery-routes.js';
 import { handleRulesRoutes } from './routes/rules-routes.js';
@@ -162,6 +164,7 @@ const MODULE_FILES = [
   'views/prompt-history.js',
   'views/skills-manager.js',
   'views/rules-manager.js',
+  'views/commands-manager.js',
   'views/claude-manager.js',
   'views/api-settings.js',
   'views/help.js',
@@ -518,6 +521,11 @@ export async function startServer(options: ServerOptions = {}): Promise<http.Ser
         if (await handleCliRoutes(routeContext)) return;
       }
 
+      // Provider routes (/api/providers/*)
+      if (pathname.startsWith('/api/providers')) {
+        if (await handleProviderRoutes(routeContext)) return;
+      }
+
       // Claude CLAUDE.md routes (/api/memory/claude/*) and Language routes (/api/language/*)
       if (pathname.startsWith('/api/memory/claude/') || pathname.startsWith('/api/language/')) {
         if (await handleClaudeRoutes(routeContext)) return;
@@ -594,6 +602,11 @@ export async function startServer(options: ServerOptions = {}): Promise<http.Ser
         if (await handleSkillsRoutes(routeContext)) return;
       }
 
+      // Commands routes (/api/commands*)
+      if (pathname.startsWith('/api/commands')) {
+        if (await handleCommandsRoutes(routeContext)) return;
+      }
+
       // Queue routes (/api/queue*) - top-level queue API
       if (pathname.startsWith('/api/queue')) {
         if (await handleIssueRoutes(routeContext)) return;

package/ccw/src/mcp-server/index.ts

@@ -21,8 +21,8 @@ const SERVER_VERSION = '6.2.0';
 const ENV_PROJECT_ROOT = 'CCW_PROJECT_ROOT';
 const ENV_ALLOWED_DIRS = 'CCW_ALLOWED_DIRS';
 
-// Default enabled tools (core set)
-const DEFAULT_TOOLS: string[] = ['write_file', 'edit_file', 'read_file', 'smart_search', 'core_memory', 'context_cache'];
+// Default enabled tools (core set - file operations and core memory only)
+const DEFAULT_TOOLS: string[] = ['write_file', 'edit_file', 'read_file', 'core_memory'];
 
 /**
  * Get list of enabled tools from environment or defaults

package/ccw/src/templates/dashboard-css/18-cli-settings.css

@@ -65,6 +65,41 @@
 .cli-setting-control {
   margin-bottom: 0.5rem;
   flex-shrink: 0;
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+/* Small icon button for refresh etc */
+.btn-icon-sm {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 24px;
+  height: 24px;
+  padding: 0;
+  border: 1px solid hsl(var(--border));
+  border-radius: 0.375rem;
+  background: hsl(var(--background));
+  color: hsl(var(--muted-foreground));
+  cursor: pointer;
+  transition: all 0.15s ease;
+}
+
+.btn-icon-sm:hover:not(:disabled) {
+  border-color: hsl(var(--primary) / 0.5);
+  color: hsl(var(--primary));
+  background: hsl(var(--primary) / 0.05);
+}
+
+.btn-icon-sm:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.btn-icon-sm i {
+  width: 12px;
+  height: 12px;
 }
 
 .cli-setting-select {

package/ccw/src/templates/dashboard-css/37-commands.css

@@ -0,0 +1,193 @@
+/* ==========================================
+   COMMANDS MANAGER STYLES
+   ========================================== */
+
+/* Commands Manager */
+.commands-manager {
+  width: 100%;
+}
+
+.commands-manager.loading {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  min-height: 300px;
+  color: hsl(var(--muted-foreground));
+}
+
+/* Commands Header */
+.commands-header {
+  width: 100%;
+}
+
+/* Commands Stats */
+.commands-stats {
+  width: 100%;
+}
+
+/* Accordion Groups */
+.commands-accordion {
+  width: 100%;
+}
+
+.accordion-group {
+  width: 100%;
+}
+
+.accordion-header {
+  user-select: none;
+}
+
+.accordion-header:active {
+  transform: scale(0.995);
+}
+
+.accordion-content {
+  animation: expandAccordion 0.2s ease-out;
+}
+
+@keyframes expandAccordion {
+  from {
+    opacity: 0;
+    max-height: 0;
+  }
+  to {
+    opacity: 1;
+    max-height: 2000px;
+  }
+}
+
+/* Commands Grid */
+.commands-grid {
+  width: 100%;
+}
+
+/* Command Card */
+.command-card {
+  position: relative;
+  transition: all 0.2s ease;
+}
+
+.command-card:hover {
+  border-color: hsl(var(--primary));
+  transform: translateY(-2px);
+}
+
+/* Toggle Switch */
+.command-toggle-switch {
+  display: inline-block;
+  position: relative;
+}
+
+.command-toggle-switch input {
+  opacity: 0;
+  width: 0;
+  height: 0;
+}
+
+.command-toggle-slider {
+  position: relative;
+  display: block;
+  cursor: pointer;
+  user-select: none;
+}
+
+.command-toggle-slider::before {
+  position: absolute;
+  content: "";
+  height: 18px;
+  width: 18px;
+  left: 2px;
+  top: 50%;
+  transform: translateY(-50%);
+  background-color: white;
+  transition: 0.2s;
+  border-radius: 50%;
+}
+
+.command-toggle-switch input:checked + .command-toggle-slider::before {
+  transform: translate(20px, -50%);
+}
+
+.command-toggle-switch input:disabled + .command-toggle-slider {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+
+/* Disabled Command State */
+.command-card.opacity-60 {
+  opacity: 0.6;
+  filter: grayscale(0.3);
+}
+
+.command-card.opacity-60:hover {
+  opacity: 0.8;
+}
+
+/* Line clamp utility for card descriptions */
+.line-clamp-2 {
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+}
+
+/* Responsive adjustments */
+@media (max-width: 768px) {
+  .commands-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .commands-stats .grid {
+    grid-template-columns: 1fr;
+  }
+
+  .accordion-header {
+    flex-wrap: wrap;
+  }
+}
+
+/* Badge styles for groups */
+.command-card .badge {
+  font-size: 0.75rem;
+  font-weight: 500;
+}
+
+/* Hover effects */
+.accordion-header:hover {
+  background-color: hsl(var(--hover));
+}
+
+/* Active state for toggle button */
+.commands-header button.bg-primary {
+  background-color: hsl(var(--primary));
+  color: hsl(var(--primary-foreground));
+}
+
+.commands-header button.bg-muted {
+  background-color: hsl(var(--muted));
+  color: hsl(var(--muted-foreground));
+}
+
+/* Smooth transitions */
+.command-toggle-slider,
+.command-toggle-slider::before {
+  transition: all 0.2s ease;
+}
+
+/* Icon animations */
+.accordion-header i[data-lucide="chevron-down"],
+.accordion-header i[data-lucide="chevron-right"] {
+  transition: transform 0.2s ease;
+}
+
+/* Focus states for accessibility */
+.command-toggle-switch input:focus + .command-toggle-slider {
+  box-shadow: 0 0 0 2px hsl(var(--ring));
+}
+
+/* Tooltip for disabled date */
+.command-card .text-muted-foreground\/70 {
+  opacity: 0.7;
+}

package/ccw/src/templates/dashboard-js/components/navigation.js

@@ -143,6 +143,8 @@ function initNavigation() {
         renderSkillsManager();
       } else if (currentView === 'rules-manager') {
         renderRulesManager();
+      } else if (currentView === 'commands-manager') {
+        renderCommandsManager();
       } else if (currentView === 'claude-manager') {
         renderClaudeManager();
         // Register destroy function for claude-manager view
@@ -223,6 +225,8 @@ function updateContentTitle() {
     titleEl.textContent = t('title.skillsManager');
   } else if (currentView === 'rules-manager') {
     titleEl.textContent = t('title.rulesManager');
+  } else if (currentView === 'commands-manager') {
+    titleEl.textContent = t('title.commandsManager') || 'Commands Manager';
   } else if (currentView === 'claude-manager') {
     titleEl.textContent = t('title.claudeManager');
   } else if (currentView === 'graph-explorer') {

package/ccw/src/templates/dashboard-js/i18n.js

@@ -1588,9 +1588,67 @@ const i18n = {
     'skills.generate': 'Generate',
     'skills.cliGenerateInfo': 'AI will generate a complete skill based on your description',
     'skills.cliGenerateTimeHint': 'Generation may take a few minutes depending on complexity',
+    'skills.disable': 'Disable',
+    'skills.enable': 'Enable',
+    'skills.disabled': 'Disabled',
+    'skills.enabled': 'Enabled',
+    'skills.disabledSkills': 'Disabled Skills',
+    'skills.disabledAt': 'Disabled at',
+    'skills.enableConfirm': 'Are you sure you want to enable the skill "{name}"?',
+    'skills.disableConfirm': 'Are you sure you want to disable the skill "{name}"?',
+    'skills.noDisabledSkills': 'No disabled skills',
+    'skills.toggleError': 'Failed to toggle skill status',
+    'skills.enableSuccess': 'Skill "{name}" enabled successfully',
+    'skills.disableSuccess': 'Skill "{name}" disabled successfully',
 
     // Rules
     'nav.rules': 'Rules',
+    'nav.commands': 'Commands',
+    'title.commandsManager': 'Commands Manager',
+    'commands.title': 'Commands Manager',
+    'commands.description': 'Manage Claude Code commands - enable, disable, and organize by group',
+    'commands.totalCommands': 'Total Commands',
+    'commands.enabledCommands': 'Enabled Commands',
+    'commands.disabledCommands': 'Disabled Commands',
+    'commands.showDisabled': 'Show Disabled',
+    'commands.hideDisabled': 'Hide Disabled',
+    'commands.noDescription': 'No description',
+    'commands.disabledAt': 'Disabled at',
+    'commands.enableConfirm': 'Enable command "{name}"?',
+    'commands.disableConfirm': 'Disable command "{name}"?',
+    'commands.enableSuccess': 'Command "{name}" enabled successfully',
+    'commands.disableSuccess': 'Command "{name}" disabled successfully',
+    'commands.toggleError': 'Failed to toggle command status',
+    'commands.enabled': 'enabled',
+    'commands.disabled': 'disabled',
+    'commands.name': 'Name',
+    'commands.description': 'Description',
+    'commands.scope': 'Scope',
+    'commands.status': 'Status',
+    'commands.group.cli': 'CLI',
+    'commands.group.workflow': 'Workflow',
+    'commands.group.memory': 'Memory',
+    'commands.group.task': 'Task',
+    'commands.group.issue': 'Issue',
+    'commands.group.other': 'Other',
+    'commands.group.review': 'Review',
+    'commands.group.execute': 'Execute',
+    'commands.group.plan': 'Plan',
+    'commands.group.test': 'Test',
+    'commands.group.debug': 'Debug',
+    'commands.group.tools': 'Tools',
+    'commands.enableAll': 'Enable All',
+    'commands.disableAll': 'Disable All',
+    'commands.enableGroupConfirm': 'Enable all commands in "{group}" group?',
+    'commands.disableGroupConfirm': 'Disable all commands in "{group}" group?',
+    'commands.enableGroupSuccess': 'Group "{group}" enabled successfully',
+    'commands.disableGroupSuccess': 'Group "{group}" disabled successfully',
+    'commands.locationProject': 'Project',
+    'commands.locationUser': 'Global',
+    'commands.clickToEnableAll': 'Click to enable all commands in this group',
+    'commands.clickToDisableAll': 'Click to disable all commands in this group',
+
+    // Rules
     'title.rulesManager': 'Rules Manager',
     'rules.title': 'Rules Manager',
     'rules.description': 'Manage project and user rules for Claude Code',
@@ -4212,9 +4270,67 @@ const i18n = {
     'skills.generate': '生成',
     'skills.cliGenerateInfo': 'AI 将根据你的描述生成完整的技能',
     'skills.cliGenerateTimeHint': '生成时间取决于复杂度，可能需要几分钟',
+    'skills.disable': '禁用',
+    'skills.enable': '启用',
+    'skills.disabled': '已禁用',
+    'skills.enabled': '已启用',
+    'skills.disabledSkills': '已禁用的技能',
+    'skills.disabledAt': '禁用时间',
+    'skills.enableConfirm': '确定要启用技能 "{name}" 吗？',
+    'skills.disableConfirm': '确定要禁用技能 "{name}" 吗？',
+    'skills.noDisabledSkills': '没有已禁用的技能',
+    'skills.toggleError': '切换技能状态失败',
+    'skills.enableSuccess': '技能 "{name}" 启用成功',
+    'skills.disableSuccess': '技能 "{name}" 禁用成功',
 
     // Rules
     'nav.rules': '规则',
+    'nav.commands': '命令',
+    'title.commandsManager': '命令管理',
+    'commands.title': '命令管理',
+    'commands.description': '管理 Claude Code 命令 - 启用、禁用和按组织分组',
+    'commands.totalCommands': '总命令数',
+    'commands.enabledCommands': '已启用命令',
+    'commands.disabledCommands': '已禁用命令',
+    'commands.showDisabled': '显示已禁用',
+    'commands.hideDisabled': '隐藏已禁用',
+    'commands.noDescription': '无描述',
+    'commands.disabledAt': '禁用于',
+    'commands.enableConfirm': '启用命令 "{name}"？',
+    'commands.disableConfirm': '禁用命令 "{name}"？',
+    'commands.enableSuccess': '命令 "{name}" 已成功启用',
+    'commands.disableSuccess': '命令 "{name}" 已成功禁用',
+    'commands.toggleError': '切换命令状态失败',
+    'commands.enabled': '已启用',
+    'commands.disabled': '已禁用',
+    'commands.name': '名称',
+    'commands.description': '描述',
+    'commands.scope': '作用域',
+    'commands.status': '状态',
+    'commands.group.cli': 'CLI',
+    'commands.group.workflow': '工作流',
+    'commands.group.memory': '记忆',
+    'commands.group.task': '任务',
+    'commands.group.issue': '问题',
+    'commands.group.other': '其他',
+    'commands.group.review': '审查',
+    'commands.group.execute': '执行',
+    'commands.group.plan': '规划',
+    'commands.group.test': '测试',
+    'commands.group.debug': '调试',
+    'commands.group.tools': '工具',
+    'commands.enableAll': '全部启用',
+    'commands.disableAll': '全部禁用',
+    'commands.enableGroupConfirm': '启用 "{group}" 分组中的所有命令？',
+    'commands.disableGroupConfirm': '禁用 "{group}" 分组中的所有命令？',
+    'commands.enableGroupSuccess': '分组 "{group}" 已全部启用',
+    'commands.disableGroupSuccess': '分组 "{group}" 已全部禁用',
+    'commands.locationProject': '项目',
+    'commands.locationUser': '全局',
+    'commands.clickToEnableAll': '点击启用该分组所有命令',
+    'commands.clickToDisableAll': '点击禁用该分组所有命令',
+
+    // Rules
     'title.rulesManager': '规则管理',
     'rules.title': '规则管理',
     'rules.description': '管理 Claude Code 的项目和用户规则',