heyiam 0.2.29 → 0.3.1

package/dist/routes/projects.js

@@ -1,6 +1,8 @@
 import { Router } from 'express';
 import { statSync } from 'node:fs';
-import { buildSessionList, buildProjectDetail } from './context.js';
+import { loadProjectEnhanceResult, saveProjectEnhanceResult } from '../settings.js';
+import { requireProject, buildSessionList, buildProjectDetail } from './context.js';
+import { invalidatePortfolioPreviewCache } from './preview.js';
 export function createProjectsRouter(ctx) {
     const router = Router();
     router.get('/api/projects', async (_req, res) => {
@@ -18,13 +20,10 @@ export function createProjectsRouter(ctx) {
     // Aggregated project detail for the hub screen
     router.get('/api/projects/:project/detail', async (req, res) => {
         try {
-            const { project } = req.params;
-            const projects = await ctx.getProjects();
-            const proj = projects.find((p) => p.name === project || p.dirName === project);
-            if (!proj) {
-                res.status(404).json({ error: 'Project not found' });
+            const project = String(req.params.project);
+            const proj = await requireProject(ctx, project, res);
+            if (!proj)
                 return;
-            }
             res.json(buildProjectDetail(ctx.db, proj));
         }
         catch (err) {
@@ -95,13 +94,11 @@ export function createProjectsRouter(ctx) {
     });
     router.get('/api/projects/:project/sessions/:id', async (req, res) => {
         try {
-            const { project, id } = req.params;
-            const projects = await ctx.getProjects();
-            const proj = projects.find((p) => p.name === project || p.dirName === project);
-            if (!proj) {
-                res.status(404).json({ error: { code: 'PROJECT_NOT_FOUND', message: 'Project not found' } });
+            const project = String(req.params.project);
+            const id = String(req.params.id);
+            const proj = await requireProject(ctx, project, res);
+            if (!proj)
                 return;
-            }
             const meta = proj.sessions.find((s) => s.sessionId === id);
             if (!meta) {
                 res.status(404).json({ error: { code: 'SESSION_NOT_FOUND', message: 'Session not found' } });
@@ -140,13 +137,10 @@ export function createProjectsRouter(ctx) {
     router.get('/api/projects/:project/git-remote', async (req, res) => {
         const { execFileSync } = await import('node:child_process');
         try {
-            const { project } = req.params;
-            const projects = await ctx.getProjects();
-            const proj = projects.find((p) => p.name === project || p.dirName === project);
-            if (!proj) {
-                res.status(404).json({ error: { code: 'PROJECT_NOT_FOUND', message: 'Project not found' } });
+            const project = String(req.params.project);
+            const proj = await requireProject(ctx, project, res);
+            if (!proj)
                 return;
-            }
             let projectPath = null;
             for (const meta of proj.sessions) {
                 try {
@@ -181,12 +175,55 @@ export function createProjectsRouter(ctx) {
             res.status(500).json({ error: { code: 'GIT_REMOTE_FAILED', message: err.message } });
         }
     });
-    // ── Boundaries ────────────────────────────────────────────────
-    router.get('/api/projects/:project/boundaries', (_req, res) => {
-        res.json({ selectedSessionIds: [], skippedSessions: [] });
+    // ── Boundaries — manage which sessions belong to a project ───
+    router.get('/api/projects/:project/boundaries', async (req, res) => {
+        try {
+            const project = String(req.params.project);
+            const proj = await requireProject(ctx, project, res);
+            if (!proj)
+                return;
+            const cache = loadProjectEnhanceResult(proj.dirName);
+            const allSessionIds = proj.sessions
+                .filter((s) => !s.isSubagent)
+                .map((s) => s.sessionId);
+            res.json({
+                selectedSessionIds: cache?.selectedSessionIds ?? [],
+                allSessionIds,
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: { code: 'BOUNDARIES_FAILED', message: err.message } });
+        }
     });
-    router.put('/api/projects/:project/boundaries', (_req, res) => {
-        res.json({ ok: true });
+    router.put('/api/projects/:project/boundaries', async (req, res) => {
+        try {
+            const project = String(req.params.project);
+            const proj = await requireProject(ctx, project, res);
+            if (!proj)
+                return;
+            const { selectedSessionIds } = req.body;
+            if (!Array.isArray(selectedSessionIds) || selectedSessionIds.length === 0) {
+                res.status(400).json({ error: { code: 'INVALID_INPUT', message: 'selectedSessionIds must be a non-empty array' } });
+                return;
+            }
+            const allIds = new Set(proj.sessions.map((s) => s.sessionId));
+            const invalid = selectedSessionIds.filter((id) => !allIds.has(id));
+            if (invalid.length > 0) {
+                res.status(400).json({ error: { code: 'INVALID_SESSION_IDS', message: `Unknown session IDs: ${invalid.join(', ')}` } });
+                return;
+            }
+            const cache = loadProjectEnhanceResult(proj.dirName);
+            if (!cache) {
+                res.status(400).json({ error: { code: 'NO_CACHE', message: 'Project must be enhanced before managing sessions' } });
+                return;
+            }
+            saveProjectEnhanceResult(proj.dirName, selectedSessionIds, cache.result, undefined, { title: cache.title, repoUrl: cache.repoUrl, projectUrl: cache.projectUrl, screenshotBase64: cache.screenshotBase64 });
+            invalidatePortfolioPreviewCache();
+            res.json({ ok: true, selectedSessionIds });
+        }
+        catch (err) {
+            res.status(500).json({ error: { code: 'BOUNDARIES_FAILED', message: err.message } });
+        }
     });
     return router;
 }

package/dist/routes/publish.js

@@ -1,15 +1,23 @@
 import { Router } from 'express';
-import { readFileSync } from 'node:fs';
+import { readFileSync, mkdtempSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { getAuthToken } from '../auth.js';
-import { API_URL, PUBLIC_URL } from '../config.js';
-import { loadEnhancedData, saveEnhancedData, saveUploadedState } from '../settings.js';
+import { API_URL, PUBLIC_URL, warnIfNonDefaultApiUrl } from '../config.js';
+import { loadEnhancedData, saveEnhancedData, saveUploadedState, getDefaultTemplate, getPortfolioProfile, hashPortfolioProfile, updatePortfolioPublishTarget, getPortfolioPublishState, isTranscriptIncluded, DEFAULT_PORTFOLIO_TARGET, } from '../settings.js';
+import { generatePortfolioHtmlFragment, generateProjectHtmlFragment, generatePortfolioSite, createZipBuffer } from '../export.js';
+import { buildPortfolioRenderData } from './portfolio-render-data.js';
+import { buildProjectDetail } from './context.js';
 import { captureScreenshot } from '../screenshot.js';
 import { redactSession, redactText, scanTextSync, formatFindings, stripHomePathsInText } from '../redact.js';
 import { renderProjectHtml, renderSessionHtml } from '../render/index.js';
 import { buildSessionRenderData, buildSessionCard, buildProjectRenderData } from '../render/build-render-data.js';
 import { buildAgentSummary } from './context.js';
+import { invalidatePortfolioPreviewCache } from './preview.js';
+import { startSSE } from './sse.js';
 import { displayNameFromDir } from '../sync.js';
+import { toSlug } from '../format-utils.js';
 import { getProjectUuid, getFileCountWithChildren } from '../db.js';
 const IMAGE_KEY_PREFIX = 'images/';
 export function createPublishRouter(ctx) {
@@ -32,7 +40,8 @@ export function createPublishRouter(ctx) {
                 totalTokens,
                 sessionCards: sessionCards || [],
             });
-            const html = renderProjectHtml(renderData);
+            const templateName = getDefaultTemplate() || 'editorial';
+            const html = renderProjectHtml(renderData, undefined, templateName);
             res.json({ html });
         }
         catch (err) {
@@ -55,6 +64,8 @@ export function createPublishRouter(ctx) {
             }
             const imageData = readFileSync(screenshotPath);
             const base64 = imageData.toString('base64');
+            // Portfolio listing shows project screenshots — bust the cache.
+            invalidatePortfolioPreviewCache();
             res.json({ ok: true, preview: `data:image/png;base64,${base64}` });
         }
         catch (err) {
@@ -65,6 +76,7 @@ export function createPublishRouter(ctx) {
     router.post('/api/projects/:project/upload', async (req, res) => {
         const { project } = req.params;
         const auth = getAuthToken();
+        warnIfNonDefaultApiUrl();
         if (!auth) {
             res.status(401).json({ error: { message: 'Authentication required' } });
             return;
@@ -72,18 +84,11 @@ export function createPublishRouter(ctx) {
         const { title: rawTitle, slug: rawSlug, narrative, repoUrl, projectUrl, timeline, skills, totalSessions, totalLoc, totalDurationMinutes, totalAgentDurationMinutes, totalFilesChanged, skippedSessions, selectedSessionIds, screenshotBase64, } = req.body;
         // Ensure slug is the short project name, not the full encoded directory path
         const shortName = displayNameFromDir(String(project));
-        const baseSlug = shortName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+        const baseSlug = toSlug(shortName);
         const title = rawTitle === rawSlug ? shortName : rawTitle;
         // Get stable project UUID from CLI database
         const clientProjectId = getProjectUuid(ctx.db, String(project));
-        res.writeHead(200, {
-            'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
-            Connection: 'keep-alive',
-        });
-        const send = (data) => {
-            res.write(`data: ${JSON.stringify(data)}\n\n`);
-        };
+        const send = startSSE(res);
         try {
             // Step 1: Upsert project on Phoenix (with slug conflict retry)
             send({ type: 'project', status: 'creating' });
@@ -207,6 +212,7 @@ export function createPublishRouter(ctx) {
             const failedSessions = [];
             const uploadedSessionCards = [];
             if (proj) {
+                const selectedTemplate = getDefaultTemplate() || 'editorial';
                 for (const sessionId of selectedSessionIds) {
                     const meta = proj.sessions.find((s) => s.sessionId === sessionId);
                     if (!meta)
@@ -215,8 +221,8 @@ export function createPublishRouter(ctx) {
                     try {
                         const session = await ctx.loadSession(meta.path, proj.name, sessionId);
                         const enhanced = loadEnhancedData(sessionId);
-                        const sessionSlug = (enhanced?.title ?? session.title ?? sessionId)
-                            .toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 80);
+                        const sessionSlug = toSlug(enhanced?.title ?? session.title ?? sessionId, 80);
+                        const includeTranscript = isTranscriptIncluded(sessionId);
                         const agentSummary = await buildAgentSummary(meta.children ?? [], (c) => ctx.getSessionStats(c, proj.name), { deduplicate: true });
                         const devTake = (enhanced?.developerTake ?? session.developerTake ?? '').slice(0, 2000);
                         const sessionNarrative = enhanced?.narrative ?? '';
@@ -233,11 +239,12 @@ export function createPublishRouter(ctx) {
                             sessionSlug,
                             sourceTool: sessionSourceTool,
                             agentSummary,
+                            template: selectedTemplate,
                         };
                         let sessionRenderedHtml = null;
                         try {
                             const sessionRenderData = buildSessionRenderData(renderOpts);
-                            sessionRenderedHtml = renderSessionHtml(sessionRenderData);
+                            sessionRenderedHtml = renderSessionHtml(sessionRenderData, selectedTemplate);
                         }
                         catch (renderErr) {
                             console.error(`[upload] Session render failed for ${sessionId}:`, renderErr.message);
@@ -259,7 +266,7 @@ export function createPublishRouter(ctx) {
                                 end_time: session.endTime ? new Date(session.endTime).toISOString() : null,
                                 cwd: session.cwd ?? null,
                                 wall_clock_minutes: session.wallClockMinutes ?? null,
-                                template: 'editorial',
+                                template: selectedTemplate,
                                 language: null,
                                 tools: session.toolBreakdown?.map((t) => t.tool) ?? [],
                                 skills: sessionSkills,
@@ -273,6 +280,22 @@ export function createPublishRouter(ctx) {
                                 rendered_html: sessionRenderedHtml,
                             },
                         };
+                        // Transcript-derived fields. When the user has toggled the
+                        // transcript OFF for this session we omit them from the
+                        // uploaded JSON entirely — see the spread below. The
+                        // session's main payload (dev take, skills, Q&A, etc.) is
+                        // unaffected.
+                        const turnTimeline = (session.turnTimeline ?? []).map((t) => ({
+                            timestamp: t.timestamp,
+                            type: t.type,
+                            content: (t.content ?? '').slice(0, 200),
+                            tools: t.tools ?? [],
+                        }));
+                        const transcriptExcerpt = (session.rawLog ?? []).slice(0, 10).map((line, i) => {
+                            const role = line.startsWith('> ') ? 'dev' : 'ai';
+                            const text = role === 'dev' ? line.slice(2) : line;
+                            return { role, id: `Turn ${i + 1}`, text, timestamp: null };
+                        });
                         const sessionData = {
                             version: 1,
                             id: sessionId,
@@ -293,7 +316,7 @@ export function createPublishRouter(ctx) {
                             })(),
                             cwd: session.cwd ?? null,
                             wall_clock_minutes: session.wallClockMinutes ?? null,
-                            template: 'editorial',
+                            template: selectedTemplate,
                             skills: sessionSkills,
                             tools: session.toolBreakdown?.map((t) => t.tool) ?? [],
                             source: sessionSourceTool,
@@ -310,17 +333,8 @@ export function createPublishRouter(ctx) {
                             highlights: [],
                             tool_breakdown: (session.toolBreakdown ?? []).map((t) => ({ tool: t.tool, count: t.count })),
                             top_files: (session.filesChanged ?? []).slice(0, 20).map((f) => (typeof f === 'string' ? { path: f, additions: 0, deletions: 0 } : f)),
-                            turn_timeline: (session.turnTimeline ?? []).map((t) => ({
-                                timestamp: t.timestamp,
-                                type: t.type,
-                                content: (t.content ?? '').slice(0, 200),
-                                tools: t.tools ?? [],
-                            })),
-                            transcript_excerpt: (session.rawLog ?? []).slice(0, 10).map((line, i) => {
-                                const role = line.startsWith('> ') ? 'dev' : 'ai';
-                                const text = role === 'dev' ? line.slice(2) : line;
-                                return { role, id: `Turn ${i + 1}`, text, timestamp: null };
-                            }),
+                            ...(includeTranscript ? { turn_timeline: turnTimeline } : {}),
+                            ...(includeTranscript ? { transcript_excerpt: transcriptExcerpt } : {}),
                             agent_summary: agentSummary,
                             children: agentSummary?.agents?.map((a) => ({
                                 sessionId: a.role,
@@ -349,7 +363,12 @@ export function createPublishRouter(ctx) {
                             uploadedCount++;
                             try {
                                 const sesData = await sessionRes.json();
-                                if (sesData.upload_urls) {
+                                if (sesData.upload_urls && includeTranscript) {
+                                    // Transcript-bearing S3 uploads. Skipped entirely when
+                                    // the user has toggled the transcript OFF for this
+                                    // session — the server never sees raw_log, turn
+                                    // timeline, or the bundled session-data JSON in that
+                                    // case.
                                     const { raw: rawUrl, log: logUrl } = sesData.upload_urls;
                                     if (rawUrl && meta.path && !meta.path.startsWith('cursor://')) {
                                         try {
@@ -425,7 +444,14 @@ export function createPublishRouter(ctx) {
                     const screenshotUrl = uploadedImageKey
                         ? `${PUBLIC_URL}/_img/${uploadedImageKey.replace(IMAGE_KEY_PREFIX, '')}`
                         : undefined;
-                    const projectHtml = generateProjectHtmlFragment(String(project), enrichedCache, detail.sessions, auth.username, { totalFilesChanged: totalFiles, title, screenshotUrl });
+                    const detailProj = detail.project;
+                    const projectHtml = generateProjectHtmlFragment(String(project), enrichedCache, detail.sessions, auth.username, {
+                        totalFilesChanged: totalFiles,
+                        title,
+                        screenshotUrl,
+                        totalInputTokens: detailProj.totalInputTokens,
+                        totalOutputTokens: detailProj.totalOutputTokens,
+                    });
                     const renderRes = await fetch(`${API_URL}/api/projects`, {
                         method: 'POST',
                         headers: {
@@ -492,5 +518,268 @@ export function createPublishRouter(ctx) {
             res.end();
         }
     });
+    // Read the current portfolio publish state (per-target snapshots, hashes,
+    // last errors, visibility). Authenticated via the same Bearer pattern as
+    // the upload route — the state file lives in the user's local config dir
+    // but it still references the signed-in identity, so don't leak it to
+    // unauthenticated callers.
+    router.get('/api/portfolio/state', async (_req, res) => {
+        const auth = getAuthToken();
+        if (!auth) {
+            res.status(401).json({
+                error: { code: 'UNAUTHENTICATED', message: 'Authentication required' },
+            });
+            return;
+        }
+        try {
+            const state = getPortfolioPublishState();
+            res.json(state);
+        }
+        catch (err) {
+            const message = err.message;
+            console.error('[portfolio-state] Error:', message);
+            res.status(500).json({
+                error: { code: 'PORTFOLIO_STATE_READ_FAILED', message },
+            });
+        }
+    });
+    // Publish portfolio landing page to heyi.am
+    // Renders the portfolio HTML fragment locally, POSTs it to Phoenix,
+    // and persists the published snapshot + hash to settings on success.
+    router.post('/api/portfolio/upload', async (req, res) => {
+        const auth = getAuthToken();
+        warnIfNonDefaultApiUrl();
+        if (!auth) {
+            res.status(401).json({
+                error: { code: 'UNAUTHENTICATED', message: 'Authentication required' },
+            });
+            return;
+        }
+        try {
+            const profile = getPortfolioProfile();
+            const templateName = getDefaultTemplate() || 'editorial';
+            const { renderData, filteredProjects } = await buildPortfolioRenderData(ctx, auth);
+            const renderedHtml = generatePortfolioHtmlFragment(renderData, templateName);
+            // Upload individual project pages for every project included in the
+            // portfolio. This ensures project detail pages exist on heyi.am even
+            // if the user never published them individually.
+            for (const rawProj of filteredProjects) {
+                try {
+                    const detail = buildProjectDetail(ctx.db, rawProj);
+                    const proj = detail.project;
+                    const cache = detail.enhanceCache
+                        ?? { fingerprint: 'portfolio-upload', enhancedAt: new Date().toISOString(), selectedSessionIds: detail.sessions.map((s) => s.id), result: { narrative: '', arc: [], skills: [], timeline: [], questions: [] } };
+                    const title = cache.title
+                        || proj.name || displayNameFromDir(rawProj.dirName);
+                    const slug = toSlug(title);
+                    const clientProjectId = getProjectUuid(ctx.db, rawProj.dirName);
+                    const projectHtml = generateProjectHtmlFragment(rawProj.dirName, cache, detail.sessions, auth.username, {
+                        totalFilesChanged: proj.totalFiles,
+                        totalAgentDurationMinutes: proj.totalAgentDuration,
+                        totalInputTokens: proj.totalInputTokens,
+                        totalOutputTokens: proj.totalOutputTokens,
+                    });
+                    await fetch(`${API_URL}/api/projects`, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/json',
+                            Authorization: `Bearer ${auth.token}`,
+                        },
+                        body: JSON.stringify({
+                            project: {
+                                client_project_id: clientProjectId,
+                                title, slug,
+                                narrative: cache.result?.narrative ?? '',
+                                skills: cache.result?.skills ?? [],
+                                total_sessions: proj.sessionCount,
+                                total_loc: proj.totalLoc,
+                                total_duration_minutes: proj.totalDuration,
+                                total_agent_duration_minutes: proj.totalAgentDuration || null,
+                                total_files_changed: proj.totalFiles,
+                                total_input_tokens: proj.totalInputTokens,
+                                total_output_tokens: proj.totalOutputTokens,
+                                rendered_html: projectHtml,
+                            },
+                        }),
+                    });
+                }
+                catch (projErr) {
+                    console.warn(`[portfolio-upload] skipping project ${rawProj.dirName}:`, projErr.message);
+                }
+            }
+            // POST portfolio landing page to Phoenix.
+            // Phoenix sanitizes the HTML, persists to users.rendered_portfolio_html,
+            // and applies the optional profile snapshot via Accounts.update_user_profile.
+            const phoenixRes = await fetch(`${API_URL}/api/portfolio/upload`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${auth.token}`,
+                },
+                body: JSON.stringify({
+                    html: renderedHtml,
+                    profile,
+                }),
+            });
+            if (!phoenixRes.ok) {
+                const errBody = await phoenixRes.json().catch(() => null);
+                const rawErr = errBody && typeof errBody === 'object'
+                    ? errBody.error
+                    : null;
+                const errMsg = typeof rawErr === 'string'
+                    ? rawErr
+                    : (rawErr && typeof rawErr === 'object' && 'message' in rawErr)
+                        ? rawErr.message
+                        : `HTTP ${phoenixRes.status}`;
+                updatePortfolioPublishTarget(DEFAULT_PORTFOLIO_TARGET, {
+                    lastError: errMsg,
+                    lastErrorAt: new Date().toISOString(),
+                });
+                res.status(phoenixRes.status >= 500 ? 502 : phoenixRes.status).json({
+                    error: { code: 'PORTFOLIO_UPLOAD_FAILED', message: errMsg },
+                });
+                return;
+            }
+            const okBody = await phoenixRes.json().catch(() => ({}));
+            const publishedUrl = okBody.username ? `${API_URL}/${okBody.username}` : undefined;
+            const publishedAt = new Date().toISOString();
+            const hash = hashPortfolioProfile(profile);
+            updatePortfolioPublishTarget(DEFAULT_PORTFOLIO_TARGET, {
+                lastPublishedAt: publishedAt,
+                lastPublishedProfileHash: hash,
+                lastPublishedProfile: profile,
+                config: {},
+                url: publishedUrl,
+                lastError: undefined,
+                lastErrorAt: undefined,
+            });
+            // Published version of the portfolio just changed — drop any cached
+            // /preview/portfolio HTML so the next preview reflects reality.
+            invalidatePortfolioPreviewCache();
+            res.json({
+                ok: true,
+                url: publishedUrl ?? `${API_URL}/${auth.username}`,
+                publishedAt,
+                hash,
+            });
+        }
+        catch (err) {
+            const errMsg = err.message;
+            console.error('[portfolio-upload] Error:', errMsg);
+            try {
+                updatePortfolioPublishTarget(DEFAULT_PORTFOLIO_TARGET, {
+                    lastError: errMsg,
+                    lastErrorAt: new Date().toISOString(),
+                });
+            }
+            catch { /* don't mask the original error */ }
+            res.status(500).json({
+                error: { code: 'PORTFOLIO_UPLOAD_FAILED', message: errMsg },
+            });
+        }
+    });
+    // Export the portfolio as a downloadable .zip file.
+    //
+    // No path arg from the client. We render the portfolio site into a temp
+    // directory, zip it via createZipBuffer, stream the zip back as an
+    // attachment, then clean up the temp dir. Mirrors the existing
+    // single-project HTML download pattern (cli/src/routes/export.ts).
+    router.post('/api/portfolio/export', async (_req, res) => {
+        const auth = getAuthToken();
+        if (!auth) {
+            res.status(401).json({
+                error: { code: 'UNAUTHENTICATED', message: 'Authentication required' },
+            });
+            return;
+        }
+        let tmpDir = null;
+        try {
+            const templateName = getDefaultTemplate() || 'editorial';
+            const { renderData } = await buildPortfolioRenderData(ctx, auth);
+            // Build per-project inputs for generatePortfolioSite. Each project
+            // needs its full session list + enhance cache — use the same
+            // buildProjectDetail path the single-project HTML export uses so
+            // there's exactly one "load everything about a project" helper.
+            const rawProjects = await ctx.getProjects();
+            const projectInputs = [];
+            for (const rawProj of rawProjects) {
+                try {
+                    const detail = buildProjectDetail(ctx.db, rawProj);
+                    const cache = detail.enhanceCache ?? {
+                        fingerprint: 'export',
+                        enhancedAt: new Date().toISOString(),
+                        selectedSessionIds: detail.sessions.map((s) => s.id),
+                        result: {
+                            narrative: '',
+                            arc: [],
+                            skills: [],
+                            timeline: [],
+                            questions: [],
+                        },
+                    };
+                    const proj = detail.project;
+                    projectInputs.push({
+                        dirName: rawProj.dirName,
+                        cache,
+                        sessions: detail.sessions,
+                        opts: {
+                            totalFilesChanged: proj.totalFiles,
+                            totalAgentDurationMinutes: proj.totalAgentDuration,
+                            totalInputTokens: proj.totalInputTokens,
+                            totalOutputTokens: proj.totalOutputTokens,
+                        },
+                    });
+                }
+                catch (projErr) {
+                    console.warn(`[portfolio-export] skipping project ${rawProj.dirName}:`, projErr.message);
+                }
+            }
+            tmpDir = mkdtempSync(path.join(tmpdir(), 'heyiam-portfolio-'));
+            const result = await generatePortfolioSite(renderData, projectInputs, tmpDir, templateName);
+            // Read every file generated into memory keyed by its path relative
+            // to the temp dir, then zip. Skip non-files defensively (the result
+            // list is files-only, but stat lets us catch directories that snuck
+            // in via a future code path).
+            const entries = [];
+            for (const filePath of result.files) {
+                try {
+                    if (!statSync(filePath).isFile())
+                        continue;
+                    entries.push({
+                        path: path.relative(tmpDir, filePath),
+                        content: readFileSync(filePath, 'utf-8'),
+                    });
+                }
+                catch (readErr) {
+                    console.warn(`[portfolio-export] skipping unreadable file ${filePath}:`, readErr.message);
+                }
+            }
+            const zipBuffer = createZipBuffer(entries);
+            const datestamp = new Date().toISOString().slice(0, 10);
+            const safeUsername = auth.username.replace(/[^a-zA-Z0-9_-]/g, '_');
+            const filename = `portfolio-${safeUsername}-${datestamp}.zip`;
+            res.setHeader('Content-Type', 'application/zip');
+            res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+            res.setHeader('Content-Length', zipBuffer.length);
+            res.send(zipBuffer);
+        }
+        catch (err) {
+            const errMsg = err.message;
+            console.error('[portfolio-export] Error:', errMsg);
+            if (!res.headersSent) {
+                res.status(500).json({
+                    error: { code: 'PORTFOLIO_EXPORT_FAILED', message: errMsg },
+                });
+            }
+        }
+        finally {
+            if (tmpDir) {
+                try {
+                    rmSync(tmpDir, { recursive: true, force: true });
+                }
+                catch { /* best effort */ }
+            }
+        }
+    });
     return router;
 }