dr-claw 1.1.3 → 1.1.4

package/server/nanoSessionPaths.js

@@ -0,0 +1,41 @@
+/**
+ * Central Nano Claude Code session JSON location (~/.dr-claw/nano-sessions).
+ * Matches file watcher PROVIDER_WATCH_PATHS and avoids cwd-scattered drclaw-nano-*.json.
+ */
+
+import fs from 'fs/promises';
+import path from 'path';
+import os from 'os';
+
+export function getNanoDrClawSessionsRoot() {
+  return path.join(os.homedir(), '.dr-claw', 'nano-sessions');
+}
+
+export async function ensureNanoDrClawSessionsRoot() {
+  const root = getNanoDrClawSessionsRoot();
+  await fs.mkdir(root, { recursive: true });
+  return root;
+}
+
+/**
+ * Plain filename only: drclaw-nano-<sanitizedId>.json — no path segments / traversal.
+ */
+export function safeNanoSessionFilename(sessionId) {
+  const safe = String(sessionId || '').replace(/[^a-zA-Z0-9._-]/g, '');
+  if (!safe || safe.includes('..')) {
+    return null;
+  }
+  const filename = `drclaw-nano-${safe}.json`;
+  if (path.basename(filename) !== filename) {
+    return null;
+  }
+  return filename;
+}
+
+export function resolveNanoSessionAbsPath(sessionId) {
+  const filename = safeNanoSessionFilename(sessionId);
+  if (!filename) {
+    return null;
+  }
+  return path.join(getNanoDrClawSessionsRoot(), filename);
+}

package/server/openai-codex.js

@@ -22,6 +22,7 @@ import { applyStageTagsToSession, recordIndexedSession } from './utils/sessionIn
 import { classifyError, classifySDKError } from '../shared/errorClassifier.js';
 import { buildTempAttachmentFilename } from './utils/imageAttachmentFiles.js';
 import { buildCodexRealtimeTokenBudget } from './utils/sessionTokenUsage.js';
+import { expandSkillCommand } from './utils/skillExpander.js';
 
 // Track active sessions
 const activeCodexSessions = new Map();
@@ -446,14 +447,17 @@ export async function queryCodex(command, options = {}, ws) {
 
     publishSessionId(thread.id || sessionId || null);
 
-    const preparedInput = await prepareCodexInput(command, images, workingDirectory);
+    // Expand /skill-name slash commands into full SKILL.md instructions
+    const expandedCommand = await expandSkillCommand(command?.trim() || command, workingDirectory);
+
+    const preparedInput = await prepareCodexInput(expandedCommand, images, workingDirectory);
     tempImagePaths = preparedInput.tempImagePaths;
     tempDir = preparedInput.tempDir;
 
     // Execute with streaming
     // Prefer pre-uploaded attachments (buildCodexInput) over base64 temp images (prepareCodexInput)
     const codexInput = attachments
-      ? buildCodexInput(command, attachments)
+      ? buildCodexInput(expandedCommand, attachments)
       : preparedInput.input;
     const streamedTurn = await thread.runStreamed(codexInput, {
       signal: abortController.signal

package/server/openrouter.js

@@ -15,11 +15,15 @@ import path from 'path';
 import os from 'os';
 import { exec } from 'child_process';
 import { promisify } from 'util';
+import spawnAsync from './utils/spawnAsync.js';
 import { encodeProjectPath, ensureProjectSkillLinks, reconcileOpenRouterSessionIndex } from './projects.js';
 import { writeProjectTemplates } from './templates/index.js';
 import { classifyError } from '../shared/errorClassifier.js';
 import { applyStageTagsToSession, recordIndexedSession } from './utils/sessionIndex.js';
 import { createRequestId, waitForToolApproval, matchesToolPermission } from './utils/permissions.js';
+import { buildMemoryBlock } from './utils/memoryPrompt.js';
+import { expandSkillCommand } from './utils/skillExpander.js';
+import { safePath } from './utils/safePath.js';
 
 const execAsync = promisify(exec);
 
@@ -220,10 +224,9 @@ function sendMessage(ws, data) {
 // ---------------------------------------------------------------------------
 
 async function executeTool(name, args, workingDir) {
-  const resolve = (p) => {
-    if (!p) return workingDir;
-    return path.isAbsolute(p) ? p : path.resolve(workingDir, p);
-  };
+  // Constrain all paths to the project root to prevent LLM-driven
+  // prompt-injection attacks from reading/writing outside the workspace.
+  const resolve = (p) => safePath(p, workingDir);
   const trunc = (s) =>
     s.length <= MAX_OUTPUT_CHARS ? s : s.slice(0, MAX_OUTPUT_CHARS) + `\n…(truncated, ${s.length} total chars)`;
 
@@ -276,25 +279,33 @@ async function executeTool(name, args, workingDir) {
 
       case 'Glob': {
         const dir = resolve(args.path);
-        const { stdout } = await execAsync(
-          `rg --files --glob '${args.pattern}' 2>/dev/null | head -300`,
-          { cwd: dir, timeout: 30_000, maxBuffer: 1024 * 1024 },
-        ).catch(() =>
-          execAsync(`find . -name '${args.pattern}' -type f 2>/dev/null | head -300`, {
-            cwd: dir, timeout: 30_000, maxBuffer: 1024 * 1024,
-          }),
-        );
-        return trunc(stdout || '(no matches)');
+        try {
+          const { stdout } = await spawnAsync('rg', ['--files', '--glob', args.pattern], {
+            cwd: dir, timeout: 30_000,
+          });
+          const lines = stdout.split('\n').filter(Boolean).slice(0, 300);
+          return trunc(lines.join('\n') || '(no matches)');
+        } catch {
+          try {
+            const { stdout } = await spawnAsync('find', ['.', '-name', args.pattern, '-type', 'f'], {
+              cwd: dir, timeout: 30_000,
+            });
+            const lines = stdout.split('\n').filter(Boolean).slice(0, 300);
+            return trunc(lines.join('\n') || '(no matches)');
+          } catch {
+            return '(no matches)';
+          }
+        }
       }
 
       case 'Grep': {
         const target = resolve(args.path);
-        let cmd = `rg --line-number --max-count 100 --max-columns 200`;
-        if (args.include) cmd += ` --glob '${args.include}'`;
-        cmd += ` '${args.pattern.replace(/'/g, "'\\''")}' '${target}'`;
+        const rgArgs = ['--line-number', '--max-count', '100', '--max-columns', '200'];
+        if (args.include) rgArgs.push('--glob', args.include);
+        rgArgs.push('-e', args.pattern, '--', target);
         try {
-          const { stdout } = await execAsync(cmd, {
-            cwd: workingDir, timeout: 30_000, maxBuffer: 2 * 1024 * 1024,
+          const { stdout } = await spawnAsync('rg', rgArgs, {
+            cwd: workingDir, timeout: 30_000,
           });
           return trunc(stdout || '(no matches)');
         } catch (err) {
@@ -645,8 +656,9 @@ export async function queryOpenRouter(command, options = {}, ws) {
       projectName: workingDirectory ? encodeProjectPath(workingDirectory) : undefined,
     });
 
-    // ── Build conversation ─────────────────────────────────────────────
-    const systemContent = customSystemPrompt || await buildSystemPrompt(workingDirectory);
+    // ── Build conversation ───────────────────���─────────────────────────
+    const memoryBlock = options.userId ? buildMemoryBlock(options.userId) : '';
+    const systemContent = (customSystemPrompt || await buildSystemPrompt(workingDirectory)) + memoryBlock;
     const messages = [{ role: 'system', content: systemContent }];
 
     if (sessionId) {
@@ -657,8 +669,11 @@ export async function queryOpenRouter(command, options = {}, ws) {
       }
     }
 
-    messages.push({ role: 'user', content: command });
-    await appendSession(currentSessionId, { role: 'user', content: command }).catch(() => {});
+    // Expand /skill-name slash commands into full SKILL.md instructions
+    const expandedCommand = await expandSkillCommand(command?.trim() || command, workingDirectory);
+
+    messages.push({ role: 'user', content: expandedCommand });
+    await appendSession(currentSessionId, { role: 'user', content: expandedCommand }).catch(() => {});
 
     const tools = permissionMode === 'plan'
       ? TOOL_SCHEMAS.filter((t) => READ_ONLY_TOOLS.has(t.function.name))

package/server/projects.js

@@ -84,6 +84,7 @@ import {
   normalizeSessionMode,
   readExplicitSessionModeFromMetadata,
 } from './utils/sessionMode.js';
+import { resolveNanoSessionAbsPath, safeNanoSessionFilename } from './nanoSessionPaths.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const DRCLAW_SKILLS_DIR = path.join(__dirname, '..', 'skills');
@@ -1040,6 +1041,20 @@ function mapIndexedSessionToProjectSession(session, provider) {
     };
   }
 
+  if (provider === 'nano') {
+    return {
+      id: session.id,
+      summary: baseName || 'Nano Claude Code Session',
+      name: baseName || 'Nano Claude Code Session',
+      createdAt,
+      lastActivity,
+      messageCount,
+      mode,
+      tags,
+      __provider: 'nano',
+    };
+  }
+
   return {
     id: session.id,
     summary: baseName || 'New Session',
@@ -1062,6 +1077,8 @@ function getSessionPlaceholderName(provider) {
       return 'Gemini Session';
     case 'openrouter':
       return 'OpenRouter Session';
+    case 'nano':
+      return 'Nano Claude Code Session';
     default:
       return 'New Session';
   }
@@ -1384,6 +1401,7 @@ async function getProjects(userId, progressCallback = null) {
       const geminiSessions = projectSessions.filter((session) => session.provider === 'gemini');
       const openrouterSessions = projectSessions.filter((session) => session.provider === 'openrouter');
       const localSessions = projectSessions.filter((session) => session.provider === 'local');
+      const nanoSessions = projectSessions.filter((session) => session.provider === 'nano');
 
       project.sessions = claudeSessions.slice(0, 5).map((session) => mapIndexedSessionToProjectSession(session, 'claude'));
       project.sessionMeta = {
@@ -1395,6 +1413,7 @@ async function getProjects(userId, progressCallback = null) {
       project.geminiSessions = geminiSessions.slice(0, 5).map((session) => mapIndexedSessionToProjectSession(session, 'gemini'));
       project.openrouterSessions = openrouterSessions.slice(0, 5).map((session) => mapIndexedSessionToProjectSession(session, 'openrouter'));
       project.localSessions = localSessions.slice(0, 5).map((session) => mapIndexedSessionToProjectSession(session, 'local'));
+      project.nanoSessions = nanoSessions.slice(0, 5).map((session) => mapIndexedSessionToProjectSession(session, 'nano'));
 
       const taskmasterResult = await detectTaskMasterFolder(actualProjectDir).catch(() => null);
 
@@ -1879,6 +1898,119 @@ async function parseAgentTools(filePath) {
   return tools;
 }
 
+function extractNanoMessageText(content) {
+  if (typeof content === 'string') {
+    return content;
+  }
+  if (!Array.isArray(content)) {
+    return '';
+  }
+  const parts = [];
+  for (const block of content) {
+    if (typeof block === 'string') {
+      parts.push(block);
+    } else if (block && typeof block === 'object') {
+      if (block.type === 'text' && block.text) {
+        parts.push(String(block.text));
+      }
+    }
+  }
+  return parts.join('\n');
+}
+
+/**
+ * Real cwd for Nano session files. encodeProjectPath ↔ simple decode in extractProjectDirectory
+ * is lossy; session metadata and projects.path store the authoritative path.
+ */
+async function resolveNanoProjectDirectory(projectName, sessionId) {
+  const { sessionDb, projectDb } = await import('./database/db.js');
+  const session = sessionDb.getSessionById(sessionId);
+  const metaPath = session?.metadata?.projectPath;
+  if (typeof metaPath === 'string' && metaPath.trim()) {
+    return metaPath.trim();
+  }
+  const projectRow = projectDb.getProjectById(projectName);
+  if (projectRow?.path && typeof projectRow.path === 'string' && projectRow.path.trim()) {
+    return projectRow.path.trim();
+  }
+  return extractProjectDirectory(projectName);
+}
+
+/** Prefer ~/.dr-claw/nano-sessions; fall back to legacy <projectCwd>/drclaw-nano-*.json */
+async function findNanoSessionStoragePath(projectName, sessionId) {
+  const central = resolveNanoSessionAbsPath(sessionId);
+  if (central) {
+    try {
+      await fs.access(central);
+      return central;
+    } catch (_) {
+      // legacy below
+    }
+  }
+  const basename = safeNanoSessionFilename(sessionId);
+  if (!basename) {
+    return null;
+  }
+  try {
+    const projectPath = await resolveNanoProjectDirectory(projectName, sessionId);
+    const legacy = path.join(projectPath, basename);
+    await fs.access(legacy);
+    return legacy;
+  } catch (_) {
+    return null;
+  }
+}
+
+async function unlinkNanoSessionFilesEverywhere(projectName, sessionId) {
+  let deleted = false;
+  const central = resolveNanoSessionAbsPath(sessionId);
+  if (central) {
+    try {
+      await fs.unlink(central);
+      deleted = true;
+    } catch (e) {
+      if (e?.code !== 'ENOENT') {
+        throw e;
+      }
+    }
+  }
+  const basename = safeNanoSessionFilename(sessionId);
+  if (basename) {
+    try {
+      const projectPath = await resolveNanoProjectDirectory(projectName, sessionId);
+      const legacy = path.join(projectPath, basename);
+      await fs.unlink(legacy);
+      deleted = true;
+    } catch (e) {
+      if (e?.code !== 'ENOENT') {
+        throw e;
+      }
+    }
+  }
+  return deleted;
+}
+
+/** Maps nano-claude-code session.json (title, messages[]) to Dr. Claw chat message shape. */
+function nanoSessionJsonToMessages(data) {
+  const rawMessages = Array.isArray(data.messages) ? data.messages : [];
+  const savedAt = data.saved_at || '';
+  const out = [];
+  for (const m of rawMessages) {
+    const role = m.role;
+    if (role !== 'user' && role !== 'assistant') {
+      continue;
+    }
+    const text = extractNanoMessageText(m.content);
+    out.push({
+      type: 'message',
+      role,
+      content: text || '',
+      timestamp: savedAt,
+    });
+  }
+  return out;
+}
+
 // Get messages for a specific session with pagination support
 async function getSessionMessages(projectName, sessionId, limit = null, offset = 0, provider = 'claude', userId = null) {
   console.log(`[DEBUG] getSessionMessages - project: ${projectName}, session: ${sessionId}, provider: ${provider}`);
@@ -2117,6 +2249,36 @@ async function getSessionMessages(projectName, sessionId, limit = null, offset =
     }
   }
 
+  if (String(provider || '').toLowerCase() === 'nano') {
+    console.log('[DEBUG] Reading Nano Claude Code session file');
+    try {
+      const nanoPath = await findNanoSessionStoragePath(projectName, sessionId);
+      if (!nanoPath) {
+        return limit === null ? [] : { messages: [], total: 0, hasMore: false };
+      }
+      const raw = await fs.readFile(nanoPath, 'utf-8');
+      const data = JSON.parse(raw);
+      const messages = nanoSessionJsonToMessages(data);
+      console.log(`[DEBUG] Found ${messages.length} messages in Nano session file at ${nanoPath}`);
+      const total = messages.length;
+      if (limit === null) {
+        return messages;
+      }
+      const startIndex = Math.max(0, total - offset - limit);
+      const endIndex = total - offset;
+      return {
+        messages: messages.slice(startIndex, endIndex),
+        total,
+        hasMore: startIndex > 0,
+        offset,
+        limit,
+      };
+    } catch (e) {
+      console.warn(`Could not read Nano session ${sessionId}:`, e.message);
+      return limit === null ? [] : { messages: [], total: 0, hasMore: false };
+    }
+  }
+
   const projectDir = path.join(os.homedir(), '.claude', 'projects', projectName);
 
   try {
@@ -2336,6 +2498,31 @@ async function deleteSession(projectName, sessionId, provider = 'claude') {
     throw new Error(`Local GPU session ${sessionId} not found in file system or index`);
   }
 
+  if (String(provider || '').toLowerCase() === 'nano') {
+    if (!safeNanoSessionFilename(sessionId)) {
+      throw new Error('Invalid Nano session id');
+    }
+    let deletedFile = false;
+    try {
+      deletedFile = await unlinkNanoSessionFilesEverywhere(projectName, sessionId);
+    } catch (e) {
+      console.error(`[Nano] Failed to delete session ${sessionId}:`, e.message);
+      throw new Error(`Failed to delete Nano session: ${e.message}`);
+    }
+
+    const deletedIndex = indexedSession?.provider === 'nano' || deletedFile;
+    if (deletedIndex) {
+      sessionDb.deleteSession(sessionId);
+    }
+
+    if (deletedFile || deletedIndex) {
+      console.log(`[Nano] Deleted session ${sessionId}${deletedFile ? ' (removed session file if present)' : ' from index only'}`);
+      return true;
+    }
+
+    throw new Error(`Nano session ${sessionId} not found in file system or index`);
+  }
+
   const projectDir = path.join(os.homedir(), '.claude', 'projects', projectName);
 
   try {
@@ -4043,6 +4230,26 @@ async function renameSession(projectName, sessionId, newSummary, provider = 'cla
       console.error(`[Gemini] Failed to rename session ${sessionId}:`, e.message);
       throw new Error(`Failed to rename Gemini session: ${e.message}`);
     }
+  } else if (String(provider || '').toLowerCase() === 'nano') {
+    if (!safeNanoSessionFilename(sessionId)) {
+      throw new Error('Invalid Nano session id');
+    }
+    const nanoPath = await findNanoSessionStoragePath(projectName, sessionId);
+    if (!nanoPath) {
+      throw new Error(`Nano session ${sessionId} file not found`);
+    }
+    try {
+      const raw = await fs.readFile(nanoPath, 'utf-8');
+      const data = JSON.parse(raw);
+      data.title = trimmedSummary;
+      await fs.writeFile(nanoPath, JSON.stringify(data, null, 2), 'utf-8');
+      sessionDb.updateSessionName(sessionId, trimmedSummary);
+      console.log(`[Nano] Renamed session ${sessionId} to "${trimmedSummary}"`);
+      return true;
+    } catch (e) {
+      console.error(`[Nano] Failed to rename session ${sessionId}:`, e.message);
+      throw new Error(`Failed to rename Nano session: ${e.message}`);
+    }
   }
   // 2. Handle Cursor sessions (SQLite)
   else if (provider === 'cursor') {

package/server/routes/agent.js

@@ -10,10 +10,12 @@ import { queryClaudeSDK } from '../claude-sdk.js';
 import { spawnCursor } from '../cursor-cli.js';
 import { queryCodex } from '../openai-codex.js';
 import { spawnGemini } from '../gemini-cli.js';
+import { queryGeminiApi } from '../gemini-api.js';
 import { queryOpenRouter } from '../openrouter.js';
 import { queryLocalGPU } from '../local-gpu.js';
+import { spawnNanoClaudeCode } from '../nano-claude-code.js';
 import { Octokit } from '@octokit/rest';
-import { CLAUDE_MODELS, CURSOR_MODELS, CODEX_MODELS, GEMINI_MODELS, LOCAL_MODELS, OPENROUTER_MODELS } from '../../shared/modelConstants.js';
+import { CODEX_MODELS, GEMINI_MODELS, LOCAL_MODELS, NANO_CLAUDE_CODE_MODELS, OPENROUTER_MODELS } from '../../shared/modelConstants.js';
 import { IS_PLATFORM } from '../constants/config.js';
 import { getGeminiApiKeyForUser, withGeminiApiKeyEnv } from '../utils/geminiApiKey.js';
 
@@ -859,8 +861,8 @@ router.post('/', validateExternalApiKey, async (req, res) => {
     return res.status(400).json({ error: 'message is required' });
   }
 
-  if (!['claude', 'cursor', 'codex', 'gemini', 'openrouter', 'local'].includes(provider)) {
-    return res.status(400).json({ error: 'provider must be "claude", "cursor", "codex", "gemini", "openrouter", or "local"' });
+  if (!['claude', 'cursor', 'codex', 'gemini', 'openrouter', 'local', 'nano'].includes(provider)) {
+    return res.status(400).json({ error: 'provider must be "claude", "cursor", "codex", "gemini", "openrouter", "local", or "nano"' });
   }
 
   // Validate GitHub branch/PR creation requirements
@@ -982,15 +984,28 @@ router.post('/', validateExternalApiKey, async (req, res) => {
         permissionMode: 'bypassPermissions'
       }, writer);
     } else if (provider === 'gemini') {
-      console.log('🤖 Starting Gemini CLI session');
+      console.log('🤖 Starting Gemini session');
 
-      await spawnGemini(message.trim(), {
+      const geminiOptions = {
         projectPath: finalProjectPath,
         cwd: finalProjectPath,
         sessionId: null,
         env: sessionEnv,
-        model: model || GEMINI_MODELS.DEFAULT
-      }, writer);
+        model: model || GEMINI_MODELS.DEFAULT,
+        userId: req.user?.id,
+      };
+
+      const result = await queryGeminiApi(message.trim(), geminiOptions, writer);
+      if (result?.authFailed) {
+        console.log('🤖 Falling back to Gemini CLI harness');
+        await spawnGemini(message.trim(), {
+          projectPath: finalProjectPath,
+          cwd: finalProjectPath,
+          sessionId: null,
+          env: sessionEnv,
+          model: model || GEMINI_MODELS.DEFAULT
+        }, writer);
+      }
     } else if (provider === 'openrouter') {
       console.log('🤖 Starting OpenRouter session');
 
@@ -1012,6 +1027,16 @@ router.post('/', validateExternalApiKey, async (req, res) => {
         env: sessionEnv,
         permissionMode: 'bypassPermissions',
       }, writer);
+    } else if (provider === 'nano') {
+      console.log('🤖 Starting Nano Claude Code session');
+
+      await spawnNanoClaudeCode(message.trim(), {
+        projectPath: finalProjectPath,
+        cwd: finalProjectPath,
+        sessionId: null,
+        model: model || NANO_CLAUDE_CODE_MODELS.DEFAULT,
+        env: sessionEnv,
+      }, writer);
     }
 
     // Handle GitHub branch and PR creation after successful agent completion

package/server/routes/auto-research.js

@@ -27,7 +27,7 @@ function getDefaultModelForProvider(provider) {
     return CODEX_MODELS.DEFAULT || 'gpt-5.4';
   }
   if (provider === 'gemini') {
-    return GEMINI_MODELS.DEFAULT || 'gemini-3-flash-preview';
+    return GEMINI_MODELS.DEFAULT || 'gemini-2.5-flash';
   }
   if (provider === 'openrouter') {
     return OPENROUTER_MODELS.DEFAULT || 'anthropic/claude-sonnet-4';

package/server/routes/claude-btw.js

@@ -0,0 +1,55 @@
+import express from 'express';
+import { runClaudeBtw } from '../claude-sdk.js';
+
+const router = express.Router();
+
+const MAX_QUESTION_CHARS = 2000;
+const MAX_TRANSCRIPT_CHARS = 150_000;
+
+/**
+ * POST /api/claude/btw
+ * Ephemeral side question (no tools, separate from main chat session).
+ */
+router.post('/btw', async (req, res) => {
+  try {
+    const { question, transcript, projectPath, model } = req.body || {};
+    const q = typeof question === 'string' ? question.trim() : '';
+    if (!q) {
+      return res.status(400).json({ error: 'question is required' });
+    }
+    if (q.length > MAX_QUESTION_CHARS) {
+      return res.status(400).json({ error: `question exceeds ${MAX_QUESTION_CHARS} character limit` });
+    }
+
+    const raw = typeof transcript === 'string' ? transcript : '';
+    const text = raw.length > MAX_TRANSCRIPT_CHARS ? raw.slice(raw.length - MAX_TRANSCRIPT_CHARS) : raw;
+    const cwd = typeof projectPath === 'string' && projectPath.trim() ? projectPath.trim() : undefined;
+    const modelId = typeof model === 'string' && model.trim() ? model.trim() : undefined;
+
+    const ac = new AbortController();
+    res.on('close', () => {
+      if (!res.writableFinished) {
+        ac.abort();
+      }
+    });
+
+    const { answer } = await runClaudeBtw({
+      question: q,
+      transcript: text,
+      cwd,
+      model: modelId,
+      signal: ac.signal,
+    });
+
+    if (!res.headersSent) {
+      res.json({ answer });
+    }
+  } catch (error) {
+    if (!res.headersSent) {
+      console.error('[ERROR] /api/claude/btw:', error.message);
+      res.status(500).json({ error: error.message || 'btw request failed' });
+    }
+  }
+});
+
+export default router;