dr-claw 1.1.3 → 1.1.4

package/server/__tests__/gemini-session-index.test.mjs

@@ -0,0 +1,95 @@
+import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest';
+import { mkdir, mkdtemp, rm, writeFile } from 'fs/promises';
+import os from 'os';
+import path from 'path';
+
+const originalHome = process.env.HOME;
+const originalUserProfile = process.env.USERPROFILE;
+const originalDatabasePath = process.env.DATABASE_PATH;
+
+let tempRoot = null;
+
+async function loadTestModules() {
+  vi.resetModules();
+  const projects = await import('../projects.js');
+  const database = await import('../database/db.js');
+  await database.initializeDatabase();
+  return { projects, database };
+}
+
+describe('Gemini API session indexing', () => {
+  beforeEach(async () => {
+    tempRoot = await mkdtemp(path.join(os.tmpdir(), 'dr-claw-gemini-index-'));
+    process.env.HOME = tempRoot;
+    process.env.USERPROFILE = tempRoot;
+    process.env.DATABASE_PATH = path.join(tempRoot, 'db', 'auth.db');
+  });
+
+  afterEach(async () => {
+    vi.resetModules();
+
+    if (originalHome === undefined) delete process.env.HOME;
+    else process.env.HOME = originalHome;
+
+    if (originalUserProfile === undefined) delete process.env.USERPROFILE;
+    else process.env.USERPROFILE = originalUserProfile;
+
+    if (originalDatabasePath === undefined) delete process.env.DATABASE_PATH;
+    else process.env.DATABASE_PATH = originalDatabasePath;
+
+    if (tempRoot) {
+      await rm(tempRoot, { recursive: true, force: true });
+      tempRoot = null;
+    }
+  });
+
+  it('discovers API-written Gemini sessions from ~/.gemini/sessions', async () => {
+    const { projects } = await loadTestModules();
+    const projectPath = path.join(tempRoot, 'workspace', 'gemini-project');
+    const sessionId = 'gemini-api-session-1';
+    const sessionsDir = path.join(tempRoot, '.gemini', 'sessions');
+    const sessionFile = path.join(sessionsDir, `${sessionId}.jsonl`);
+
+    await mkdir(projectPath, { recursive: true });
+    await mkdir(sessionsDir, { recursive: true });
+    await writeFile(sessionFile, [
+      JSON.stringify({
+        type: 'session_meta',
+        payload: {
+          id: sessionId,
+          cwd: projectPath,
+          timestamp: '2026-04-05T12:00:00.000Z',
+          sessionMode: 'research',
+          title: 'Explore Gemini API flow',
+        },
+        cwd: projectPath,
+        timestamp: '2026-04-05T12:00:00.000Z',
+        title: 'Explore Gemini API flow',
+      }),
+      JSON.stringify({
+        type: 'message',
+        role: 'user',
+        content: 'Explore Gemini API flow',
+        timestamp: '2026-04-05T12:00:01.000Z',
+      }),
+      JSON.stringify({
+        type: 'message',
+        role: 'assistant',
+        content: 'I inspected the repository.',
+        timestamp: '2026-04-05T12:00:02.000Z',
+      }),
+      '',
+    ].join('\n'), 'utf-8');
+
+    const sessions = await projects.getGeminiSessions(projectPath, { limit: 5 });
+
+    expect(sessions).toHaveLength(1);
+    expect(sessions[0]).toEqual(expect.objectContaining({
+      id: sessionId,
+      name: 'Explore Gemini API flow',
+      mode: 'research',
+      projectPath,
+      messageCount: 2,
+    }));
+  });
+});

package/server/claude-sdk.js

@@ -25,6 +25,7 @@ import { applyStageTagsToSession, recordIndexedSession } from './utils/sessionIn
 import { buildTempAttachmentFilename } from './utils/imageAttachmentFiles.js';
 
 import { createRequestId, waitForToolApproval, resolveToolApproval as resolvePermApproval, matchesToolPermission } from './utils/permissions.js';
+import { buildMemoryBlock } from './utils/memoryPrompt.js';
 
 const activeSessions = new Map();
 const pendingClaudeSessionIndexReconciles = new Map();
@@ -143,10 +144,12 @@ function mapCliOptionsToSDK(options = {}) {
   sdkOptions.model = options.model || CLAUDE_MODELS.DEFAULT;
   console.log(`Using model: ${sdkOptions.model}`);
 
-  // Map system prompt configuration
+  // Map system prompt configuration with optional user memory injection
+  const memoryBlock = options.userId ? buildMemoryBlock(options.userId) : '';
   sdkOptions.systemPrompt = {
     type: 'preset',
-    preset: 'claude_code'  // Required to use CLAUDE.md
+    preset: 'claude_code',  // Required to use CLAUDE.md
+    ...(memoryBlock ? { append: memoryBlock } : {}),
   };
 
   // Map setting sources for CLAUDE.md loading
@@ -869,6 +872,81 @@ function getActiveClaudeSDKSessions() {
   return getAllSessions();
 }
 
+const BTW_SYSTEM_PROMPT = `You answer a short side question for someone in the middle of a coding session.
+
+Rules:
+- You have NO tools. Do not claim to read files, run commands, or fetch URLs unless that information already appears in the conversation context below.
+- Use the "Conversation context" section plus general programming knowledge. If something is not in the context, say you do not see it there.
+- Be concise.`;
+
+/**
+ * One-shot, tool-free side question (Claude Code /btw-style). Does not resume the main SDK session.
+ */
+async function runClaudeBtw({ question, transcript, cwd, model, signal }) {
+  const safeTranscript =
+    typeof transcript === 'string' && transcript.trim()
+      ? transcript
+      : '(No prior conversation in this session.)';
+  const userBlock = `## Conversation context\n\n${safeTranscript}\n\n---\n\n## Side question\n\n${question}`;
+
+  const sdkOptions = {
+    cwd: cwd || process.cwd(),
+    model: model || CLAUDE_MODELS.DEFAULT,
+    tools: [],
+    allowedTools: [],
+    settingSources: [],
+    systemPrompt: BTW_SYSTEM_PROMPT,
+    permissionMode: 'default',
+  };
+
+  const prevStreamTimeout = process.env.CLAUDE_CODE_STREAM_CLOSE_TIMEOUT;
+  process.env.CLAUDE_CODE_STREAM_CLOSE_TIMEOUT = '120000';
+
+  let answer = '';
+  let lastError = null;
+
+  try {
+    const queryInstance = query({
+      prompt: userBlock,
+      options: sdkOptions,
+    });
+
+    for await (const message of queryInstance) {
+      if (signal?.aborted) {
+        break;
+      }
+      if (message.type === 'result') {
+        if (message.subtype === 'success') {
+          answer = message.result || answer;
+        } else {
+          lastError = Array.isArray(message.errors) ? message.errors.join('\n') : 'Side question failed';
+        }
+      }
+    }
+  } catch (err) {
+    if (signal?.aborted) {
+      return { answer: '' };
+    }
+    throw new Error(err?.message || String(err));
+  } finally {
+    if (prevStreamTimeout !== undefined) {
+      process.env.CLAUDE_CODE_STREAM_CLOSE_TIMEOUT = prevStreamTimeout;
+    } else {
+      delete process.env.CLAUDE_CODE_STREAM_CLOSE_TIMEOUT;
+    }
+  }
+
+  if (signal?.aborted) {
+    return { answer: '' };
+  }
+
+  if (lastError) {
+    throw new Error(lastError);
+  }
+
+  return { answer: answer || '' };
+}
+
 // Export public API
 export {
   queryClaudeSDK,
@@ -877,5 +955,6 @@ export {
   getClaudeSDKSessionStartTime,
   getActiveClaudeSDKSessions,
   resolveToolApproval,
-  getContextWindowForModel
+  getContextWindowForModel,
+  runClaudeBtw,
 };

package/server/cli-chat.js

@@ -14,6 +14,8 @@ import path from 'path';
 import os from 'os';
 import { exec } from 'child_process';
 import { promisify } from 'util';
+import spawnAsync from './utils/spawnAsync.js';
+import { safePath } from './utils/safePath.js';
 
 const execAsync = promisify(exec);
 
@@ -164,10 +166,9 @@ const TOOL_SCHEMAS = [
 // ── Tool execution ────────────────────────────────────────────────────────────
 
 async function executeTool(name, args, workingDir) {
-  const resolve = (p) => {
-    if (!p) return workingDir;
-    return path.isAbsolute(p) ? p : path.resolve(workingDir, p);
-  };
+  // Constrain all paths to the project root to prevent LLM-driven
+  // prompt-injection attacks from reading/writing outside the workspace.
+  const resolve = (p) => safePath(p, workingDir);
   const trunc = (s) =>
     s.length <= MAX_OUTPUT_CHARS ? s : s.slice(0, MAX_OUTPUT_CHARS) + `\n…(truncated)`;
 
@@ -210,23 +211,33 @@ async function executeTool(name, args, workingDir) {
       }
       case 'Glob': {
         const dir = resolve(args.path);
-        const { stdout } = await execAsync(
-          `rg --files --glob '${args.pattern}' 2>/dev/null | head -300`,
-          { cwd: dir, timeout: 30_000, maxBuffer: 1024 * 1024 },
-        ).catch(() =>
-          execAsync(`find . -name '${args.pattern}' -type f 2>/dev/null | head -300`, {
-            cwd: dir, timeout: 30_000, maxBuffer: 1024 * 1024,
-          }),
-        );
-        return trunc(stdout || '(no matches)');
+        try {
+          const { stdout } = await spawnAsync('rg', ['--files', '--glob', args.pattern], {
+            cwd: dir, timeout: 30_000,
+          });
+          const lines = stdout.split('\n').filter(Boolean).slice(0, 300);
+          return trunc(lines.join('\n') || '(no matches)');
+        } catch {
+          try {
+            const { stdout } = await spawnAsync('find', ['.', '-name', args.pattern, '-type', 'f'], {
+              cwd: dir, timeout: 30_000,
+            });
+            const lines = stdout.split('\n').filter(Boolean).slice(0, 300);
+            return trunc(lines.join('\n') || '(no matches)');
+          } catch {
+            return '(no matches)';
+          }
+        }
       }
       case 'Grep': {
         const target = resolve(args.path);
-        let cmd = `rg --line-number --max-count 100 --max-columns 200`;
-        if (args.include) cmd += ` --glob '${args.include}'`;
-        cmd += ` '${args.pattern.replace(/'/g, "'\\''")}' '${target}'`;
+        const rgArgs = ['--line-number', '--max-count', '100', '--max-columns', '200'];
+        if (args.include) rgArgs.push('--glob', args.include);
+        rgArgs.push('-e', args.pattern, '--', target);
         try {
-          const { stdout } = await execAsync(cmd, { cwd: workingDir, timeout: 30_000, maxBuffer: 2 * 1024 * 1024 });
+          const { stdout } = await spawnAsync('rg', rgArgs, {
+            cwd: workingDir, timeout: 30_000,
+          });
           return trunc(stdout || '(no matches)');
         } catch (err) {
           if (err.code === 1) return '(no matches)';

package/server/cli.js

@@ -57,6 +57,18 @@ const c = {
 const packageJsonPath = path.join(__dirname, '../package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
 
+function stripOptionalEnvQuotes(raw) {
+    const v = String(raw).trim();
+    if (v.length >= 2) {
+        const open = v[0];
+        const close = v[v.length - 1];
+        if ((open === '"' && close === '"') || (open === "'" && close === "'")) {
+            return v.slice(1, -1);
+        }
+    }
+    return v;
+}
+
 // Load environment variables from .env file if it exists
 function loadEnvFile() {
     try {
@@ -67,7 +79,7 @@ function loadEnvFile() {
             if (trimmedLine && !trimmedLine.startsWith('#')) {
                 const [key, ...valueParts] = trimmedLine.split('=');
                 if (key && valueParts.length > 0 && !process.env[key]) {
-                    process.env[key] = valueParts.join('=').trim();
+                    process.env[key] = stripOptionalEnvQuotes(valueParts.join('='));
                 }
             }
         });

package/server/data/news-log-arxiv.json

@@ -0,0 +1 @@
+["[runtime] Using python3 | Python 3.9.6 | /Library/Developer/CommandLineTools/usr/bin/python3","/Users/dingjiesong/Library/Python/3.9/lib/python/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020","warnings.warn(","11:54:21 [INFO] Loading config from: /Users/dingjiesong/Documents/workspace/ai-scientist/dr-claw/server/data/research_interests_arxiv.json","11:54:21 [INFO] Using current date: 2026-04-09","11:54:21 [INFO] Date windows:","11:54:21 [INFO]   Recent 30 days: 2026-03-10 to 2026-04-09","11:54:21 [INFO]   Past year (31-365 days): 2025-04-09 to 2026-03-09","11:54:21 [INFO] ======================================================================","11:54:21 [INFO] Step 1: Searching recent papers (last 30 days) from arXiv","11:54:21 [INFO] ======================================================================","11:54:21 [INFO] [arXiv] Searching papers from 2026-03-10 to 2026-04-09","11:54:22 [INFO] [arXiv] Found 200 papers","11:54:22 [INFO] Scored 200 recent papers","11:54:22 [INFO] Skipping Semantic Scholar hot paper search (disabled)","11:54:22 [INFO] ======================================================================","11:54:22 [INFO] Step 3: Merging and ranking results","11:54:22 [INFO] ======================================================================","11:54:22 [INFO] Total unique papers after deduplication: 200","11:54:22 [INFO] Results saved to: /Users/dingjiesong/Documents/workspace/ai-scientist/dr-claw/server/data/news-results-arxiv.json","11:54:22 [INFO] Top 10 papers:","11:54:22 [INFO]   1. TraceSafe: A Systematic Assessment of LLM Guardrails on Mult... (Score: 10.13)","11:54:22 [INFO]   2. Appear2Meaning: A Cross-Cultural Benchmark for Structured Cu... (Score: 8.93)","11:54:22 [INFO]   3. A Systematic Study of Retrieval Pipeline Design for Retrieva... (Score: 8.53)","11:54:22 [INFO]   4. Dynamic Context Evolution for Scalable Synthetic Data Genera... (Score: 8.53)","11:54:22 [INFO]   5. Strategic Persuasion with Trait-Conditioned Multi-Agent Syst... (Score: 8.4)","11:54:22 [INFO]   6. Personalized RewardBench: Evaluating Reward Models with Huma... (Score: 8.13)","11:54:22 [INFO]   7. AgentCity: Constitutional Governance for Autonomous Agent Ec... (Score: 8.0)","11:54:22 [INFO]   8. On the Step Length Confounding in LLM Reasoning Data Selecti... (Score: 7.87)","11:54:22 [INFO]   9. STRIDE-ED: A Strategy-Grounded Stepwise Reasoning Framework ... (Score: 7.73)","11:54:22 [INFO]   10. Differentiable Environment-Trajectory Co-Optimization for Sa... (Score: 7.6)"]

package/server/data/news-log-huggingface.json

@@ -0,0 +1 @@
+["[runtime] Using python3 | Python 3.9.6 | /Library/Developer/CommandLineTools/usr/bin/python3","/Users/dingjiesong/Library/Python/3.9/lib/python/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020","warnings.warn(","11:54:28 [INFO] No config provided — showing all HuggingFace Daily Papers","11:54:28 [INFO] Fetching HuggingFace Daily Papers...","11:54:28 [INFO] [HF] Fetched 50 daily paper entries","11:54:28 [INFO] Normalized 50 papers from 50 raw entries","11:54:28 [INFO] Scored 50 papers (0 filtered out by relevance/exclusion)","11:54:28 [INFO] Results saved to: /Users/dingjiesong/Documents/workspace/ai-scientist/dr-claw/server/data/news-results-huggingface.json","11:54:28 [INFO] Top 30 papers:","11:54:28 [INFO]   1. MegaTrain: Full Precision Training of 100B+ Parameter Large ... (Score: 6.09, Upvotes-based popularity: 2.22)","11:54:28 [INFO]   2. ThinkTwice: Jointly Optimizing Large Language Models for Rea... (Score: 6.08, Upvotes-based popularity: 1.98)","11:54:28 [INFO]   3. GBQA: A Game Benchmark for Evaluating LLMs as Quality Assura... (Score: 6.07, Upvotes-based popularity: 2.34)","11:54:28 [INFO]   4. RAGEN-2: Reasoning Collapse in Agentic RL... (Score: 6.0, Upvotes-based popularity: 2.4)","11:54:28 [INFO]   5. Vanast: Virtual Try-On with Human Image Animation via Synthe... (Score: 5.97, Upvotes-based popularity: 2.1)","11:54:28 [INFO]   6. Think in Strokes, Not Pixels: Process-Driven Image Generatio... (Score: 5.85, Upvotes-based popularity: 2.28)","11:54:28 [INFO]   7. Watch Before You Answer: Learning from Visually Grounded Pos... (Score: 5.62, Upvotes-based popularity: 1.62)","11:54:28 [INFO]   8. How Well Do Agentic Skills Work in the Wild: Benchmarking LL... (Score: 5.61, Upvotes-based popularity: 1.74)","11:54:28 [INFO]   9. In-Place Test-Time Training... (Score: 5.08, Upvotes-based popularity: 1.08)","11:54:28 [INFO]   10. SEVerA: Verified Synthesis of Self-Evolving Agents... (Score: 5.0, Upvotes-based popularity: 0.9)","11:54:28 [INFO]   11. MARS: Enabling Autoregressive Models Multi-Token Generation... (Score: 4.96, Upvotes-based popularity: 1.26)","11:54:28 [INFO]   12. INSPATIO-WORLD: A Real-Time 4D World Simulator via Spatiotem... (Score: 4.94, Upvotes-based popularity: 0.84)","11:54:28 [INFO]   13. Paper Circle: An Open-source Multi-agent Research Discovery ... (Score: 4.93, Upvotes-based popularity: 1.2)","11:54:28 [INFO]   14. General Multimodal Protein Design Enables DNA-Encoding of Ch... (Score: 4.81, Upvotes-based popularity: 1.38)","11:54:28 [INFO]   15. DARE: Diffusion Large Language Models Alignment and Reinforc... (Score: 4.71, Upvotes-based popularity: 1.08)","11:54:28 [INFO]   16. ClawsBench: Evaluating Capability and Safety of LLM Producti... (Score: 4.59, Upvotes-based popularity: 1.02)","11:54:28 [INFO]   17. TC-AE: Unlocking Token Capacity for Deep Compression Autoenc... (Score: 4.54, Upvotes-based popularity: 0.54)","11:54:28 [INFO]   18. MMEmb-R1: Reasoning-Enhanced Multimodal Embedding with Pair-... (Score: 4.52, Upvotes-based popularity: 0.42)","11:54:28 [INFO]   19. FP4 Explore, BF16 Train: Diffusion Reinforcement Learning vi... (Score: 4.42, Upvotes-based popularity: 0.42)","11:54:28 [INFO]   20. MedGemma 1.5 Technical Report... (Score: 4.41, Upvotes-based popularity: 0.54)","11:54:28 [INFO]   21. FlowInOne:Unifying Multimodal Generation as Image-in, Image-... (Score: 4.4, Upvotes-based popularity: 0.3)","11:54:28 [INFO]   22. Scientific Graphics Program Synthesis via Dual Self-Consiste... (Score: 4.28, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   23. Graph-Based Chain-of-Thought Pruning for Reducing Redundant ... (Score: 4.23, Upvotes-based popularity: 0.36)","11:54:28 [INFO]   24. Experience Transfer for Multimodal LLM Agents in Minecraft G... (Score: 4.23, Upvotes-based popularity: 0.36)","11:54:28 [INFO]   25. AgentGL: Towards Agentic Graph Learning with LLMs via Reinfo... (Score: 4.22, Upvotes-based popularity: 0.12)","11:54:28 [INFO]   26. Learning to Hint for Reinforcement Learning... (Score: 4.18, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   27. Personalized RewardBench: Evaluating Reward Models with Huma... (Score: 4.18, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   28. REAM: Merging Improves Pruning of Experts in LLMs... (Score: 4.18, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   29. Context-Value-Action Architecture for Value-Driven Large Lan... (Score: 4.18, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   30. Action Images: End-to-End Policy Learning via Multiview Vide... (Score: 4.14, Upvotes-based popularity: 0.54)"]